CVE-2021-3697: GNU GRUB2 JPEG RCE Vulnerability

CVE-2021-3697 Overview

CVE-2021-3697 is a heap memory corruption vulnerability in the JPEG image reader of GNU GRUB2 bootloader versions prior to grub-2.12. A crafted JPEG image causes the JPEG reader to underflow its data pointer, allowing attacker-controlled data to be written into the heap. The vulnerability requires the attacker to perform heap layout triage and supply a maliciously formatted image with a tailored payload. Successful exploitation can result in data corruption, arbitrary code execution within the bootloader context, or circumvention of UEFI Secure Boot. The flaw affects GRUB2 packages shipped across Red Hat Enterprise Linux 8 and 9, OpenShift Container Platform, and other downstream distributions [CWE-787].

Critical Impact
Exploitation in the pre-boot environment can bypass Secure Boot, undermining the chain of trust used to protect kernel integrity and disk encryption keys.

Affected Products

GNU GRUB2 versions prior to grub-2.12
Red Hat Enterprise Linux 8.0, 8.1, 8.2, 8.4, 8.6, and 9.0 (including EUS, AUS, TUS variants)
Red Hat OpenShift Container Platform 4.6, 4.9, 4.10, and Red Hat CodeReady Linux Builder

Discovery Timeline

2022-07-06 - CVE-2021-3697 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3697

Vulnerability Analysis

The vulnerability resides in the GRUB2 JPEG decoder, a module GRUB2 uses to render splash images during the boot process. When parsing a malformed JPEG, the reader miscalculates pointer arithmetic and underflows the data pointer beneath the bounds of its allocated heap buffer. Subsequent write operations using the underflowed pointer place attacker-controlled bytes into adjacent heap regions.

Because GRUB2 executes in the pre-OS environment with full firmware privileges, heap corruption translates directly into control over the boot flow. An attacker who can stage a heap layout and place a crafted image where GRUB2 loads it can achieve arbitrary code execution before the kernel and Secure Boot policies take effect.

Root Cause

The root cause is improper bounds validation during JPEG header and segment parsing, classified as an out-of-bounds write [CWE-787]. The decoder trusts length fields embedded in the image without sufficient sanity checks, allowing internal pointer arithmetic to produce a value below the buffer base. Writes through this pointer corrupt heap metadata and adjacent chunks managed by the GRUB2 allocator.

Attack Vector

Exploitation requires local access with low privileges, such as the ability to modify the EFI System Partition or the /boot filesystem to replace the splash image referenced by grub.cfg. The attacker prepares a JPEG that triggers the underflow and shapes the GRUB2 heap so that the resulting write overwrites a function pointer or allocator structure. Because no user interaction is needed once the system reboots, the payload executes automatically in the bootloader context, providing a path to persist below the operating system and defeat Secure Boot verification.

No verified public proof-of-concept code is available. Refer to the Red Hat Bug Report #1991687 for upstream technical discussion.

Detection Methods for CVE-2021-3697

Indicators of Compromise

Unexpected modifications to files under /boot, the EFI System Partition (/boot/efi), or splash image paths referenced in grub.cfg.
Presence of unsigned or unexpected GRUB2 modules, themes, or JPEG assets that do not match the distribution package manifest.
Boot integrity measurements (TPM PCR 8/9 values) that deviate from a known-good baseline after reboot.

Detection Strategies

Verify installed grub2 package versions against vendor advisories using rpm -qa | grep grub2 and compare with patched releases.
Enable and audit TPM-based measured boot to detect changes in the GRUB2 image or its loaded resources.
Monitor file integrity on /boot, /boot/efi, and GRUB configuration files using a host integrity tool.

Monitoring Recommendations

Forward audit logs covering writes to /boot and the EFI System Partition into a centralized logging or SIEM platform.
Track package update events for grub2, grub2-efi, grub2-tools, and shim across the fleet.
Alert on the introduction of new files with .jpg or .jpeg extensions inside /boot/grub2/themes/ or referenced by grub.cfg.

How to Mitigate CVE-2021-3697

Immediate Actions Required

Apply vendor-supplied GRUB2 updates to versions at or above grub-2.12, or distribution backports addressing CVE-2021-3697.
Restrict write access to /boot, /boot/efi, and GRUB configuration files to the root account only.
Confirm Secure Boot is enabled in firmware and that the platform uses up-to-date dbx revocations from the vendor.

Patch Information

Updates are available from upstream GNU GRUB2 in releases starting with grub-2.12. Red Hat has issued errata for affected RHEL 8.x, 9.0, and OpenShift Container Platform 4.6, 4.9, and 4.10 packages. Refer to the Red Hat Bug Report #1991687, Gentoo GLSA 202209-12, and NetApp Security Advisory NTAP-20220930-0001 for distribution-specific package versions.

Workarounds

Remove custom GRUB2 themes and splash images, reverting GRUB_BACKGROUND and theme directives in /etc/default/grub to vendor defaults until patches are deployed.
Enforce full-disk encryption with TPM-bound keys so that boot-chain tampering invalidates key release.
Limit physical and administrative access to systems where bootloader modification is possible, including hypervisor consoles for virtual machines.

bash

# Verify patched GRUB2 version and rebuild configuration
rpm -q grub2-common grub2-efi-x64 grub2-tools
grub2-mkconfig -o /boot/grub2/grub.cfg
# On UEFI systems, regenerate the EFI config
grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg