CVE-2021-20233 - log back

CVE-2021-20233 edited at 02 Mar 2021 23:16:06
References
https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html
+ https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=2f533a89a8dfcacbf2c9dbc77d910f111f24bf33
CVE-2021-20233 edited at 02 Mar 2021 18:21:18
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Local
Type
- Unknown
+ Arbitrary code execution
Description
+ There's a flaw in GRUB2 menu rendering code setparam_prefix() in the menu rendering code. It performs a length calculation under the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters. This allow an attacker to corrupt memory by one byte for each quote in the input.
References
+ https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html
Notes
CVE-2021-20233 created at 02 Mar 2021 18:10:44