Skip to main content

Incorrect Default Permissions

CVE-2021-3981

Low
3.3/10

Summary

A flaw in grub2 was found where its configuration file, known as "grub.cfg", is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in "grub.cfg". This issue has been fixed in grub upstream but no version with the fix is currently released.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-276 - Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References

Advisory Timeline

  • Published