CVE-2021-46705

CWE-3774 documents4 sources
Severity
4.4MEDIUM
EPSS
0.0%
top 86.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Suse Opensuse FactorySuse Suse Linux Enterprise Server 15 SP4GNU Grub2
Timeline
PublishedMar 16
Latest updateMar 17

Description

A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LExploitability: 2.5 | Impact: 2.5

Affected Packages3 packages

▶CVEListV5suse/suse_linux_enterprise_server_15_sp4grub2 — 2.06-150400.7.1
▶CVEListV5suse/opensuse_factorygrub2 — 2.06-18.1
▶NVDgnu/grub2< 2.06-150400.7.1+1

🔴Vulnerability Details

2
GHSA
GHSA-p6fp-whjx-7g5m: A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to trunc↗2022-03-17
▶
CVEList
grub2-once uses fixed file name in /var/tmp↗2022-03-16
▶

📋Vendor Advisories

1
Debian
CVE-2021-46705: grub2 - A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Ente...↗2021
▶
CVE-2021-46705 (MEDIUM CVSS 4.4) | A Insecure Temporary File vulnerabi | cvebase.io