CVE-2021-3981

What it actually does

grub.cfg is generated with permissions allowing any local user to read its contents, exposing any encrypted passwords stored within the bootloader configuration.

Why it matters to the business

local users on affected systems may obtain bootloader passwords that were intended to remain confidential, increasing the risk of unauthorized boot parameter changes or further local privilege escalation attempts; the absence of an official fixed release extends exposure across all downstream distributions.

How an attack unfolds

an attacker with an existing local account on the system simply opens the world-readable grub.cfg file and extracts any password hashes or credentials that were placed there for bootloader protection.

How to fix it

manually set grub.cfg permissions to root-only readable (chmod 600) after every regeneration until an upstream release containing the fix is packaged by distributions; monitor grub2 package updates for the corrected version once published.

How to confirm the fix worked

verify that grub.cfg is owned by root with mode 600 and confirm no non-root users can open the file; re-run grub-mkconfig and re-check permissions after any bootloader configuration change.

Typical attack path

1. obtain a valid local user account on the target host
2. locate the grub.cfg file in its standard boot directory
3. read the file contents directly due to permissive ownership
4. extract any encrypted passwords for offline cracking or reuse

How to detect it

examine file permissions and ownership of grub.cfg across managed hosts; review local user activity logs for unexpected reads of bootloader configuration files; no network or remote indicators apply.

What your security team should do

• apply the manual permission hardening immediately on all affected systems
• add a post-install hook or cron job to enforce correct grub.cfg permissions after updates
• track distribution package repositories for the first release containing the upstream fix and deploy it as soon as available
• review any documented bootloader passwords and rotate them if exposure is confirmed