CVE-2021-3981
grub2: Incorrect permission in grub.cfg allow unprivileged user to read the file content
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · November 17, 2021
Updated · July 21, 2026
Description
A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-276 · Incorrect Default Permissions