CVE catalog

CVE-2021-3418

grub2 affected and fixed versions

If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown, yet it could have been tampered. This flaw is a reintroduction of CVE-2020-15705 and only affects grub2 versions prior to 2.06 and upstream and distributions using the shim_lock mechanism.

Severity: Medium · CVSS 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: Mar 2, 2021, 6:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.47% · Oct 27, 2026

Projects and upstream resources

[grub][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	grub2	Not reported	Not affectedDistribution reports not affected	[CVE-2021-3418]
Debiantrixie	grub2	`2.12-9+deb13u2`	Not affected	[CVE-2021-3418]
Debiansid	grub2	Not reported	Not affectedDistribution reports not affected	[CVE-2021-3418]
Debiansid	grub2	`2.14-4`	Not affected	[CVE-2021-3418]
Debianforky	grub2	Not reported	Not affectedDistribution reports not affected	[CVE-2021-3418]
Debianforky	grub2	`2.14-4`	Not affected	[CVE-2021-3418]
Debianbookworm-security	grub2	`2.06-13+deb12u1`	Not affected	[CVE-2021-3418]
Debianbookworm	grub2	Not reported	Not affectedDistribution reports not affected	[CVE-2021-3418]
Debianbookworm	grub2	`2.06-13+deb12u2`	Not affected	[CVE-2021-3418]
Alpine3.24	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.23	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.22	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC

Showing 12 observations. All 17 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Alpine3.17	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.18	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.19	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.20	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.21	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.22	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.23	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.24	grub	`2.06-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-3418]Oct 23, 2026, 5:17:56 PM UTC
Debianbookworm	grub2	Not reported	Not affectedDistribution reports not affected	[CVE-2021-3418]
Debianbookworm	grub2	`2.06-13+deb12u2`	Not affected	[CVE-2021-3418]
Debianbookworm-security	grub2	`2.06-13+deb12u1`	Not affected	[CVE-2021-3418]
Debianforky	grub2	Not reported	Not affectedDistribution reports not affected	[CVE-2021-3418]
Debianforky	grub2	`2.14-4`	Not affected	[CVE-2021-3418]
Debiansid	grub2	Not reported	Not affectedDistribution reports not affected	[CVE-2021-3418]
Debiansid	grub2	`2.14-4`	Not affected	[CVE-2021-3418]
Debiantrixie	grub2	Not reported	Not affectedDistribution reports not affected	[CVE-2021-3418]
Debiantrixie	grub2	`2.12-9+deb13u2`	Not affected	[CVE-2021-3418]

Original provider fields

{
  "package_releases": [
    {
      "name": "grub2",
      "status": "not affected",
      "release": "sid",
      "version": "2.14-4"
    },
    {
      "name": "grub2",
      "status": "not affected",
      "release": "forky",
      "version": "2.14-4"
    },
    {
      "name": "grub2",
      "status": "not affected",
      "release": "trixie",
      "version": "2.12-9+deb13u2"
    },
    {
      "name": "grub2",
      "status": "not affected",
      "release": "bookworm",
      "version": "2.06-13+deb12u2"
    },
    {
      "name": "grub2",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "2.06-13+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "grub2",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "grub2",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "grub2",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "grub2",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.17",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3418",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3418",
      "provider_updated_at": "2026-10-23T17:17:56.192622650Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.18",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3418",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3418",
      "provider_updated_at": "2026-10-23T17:17:56.192622650Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.19",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3418",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3418",
      "provider_updated_at": "2026-10-23T17:17:56.192622650Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.20",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3418",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3418",
      "provider_updated_at": "2026-10-23T17:17:56.192622650Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.21",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3418",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3418",
      "provider_updated_at": "2026-10-23T17:17:56.192622650Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.22",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3418",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3418",
      "provider_updated_at": "2026-10-23T17:17:56.192622650Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.23",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3418",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3418",
      "provider_updated_at": "2026-10-23T17:17:56.192622650Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.24",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-3418",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-3418",
      "provider_updated_at": "2026-10-23T17:17:56.192622650Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[grub2]Unknown
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub2-common]Unknown
Source package: [grub2]
Details (6)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-common]Unknown
Source package: [grub2]
Details (6)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-coreboot]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-coreboot-bin]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-coreboot-dbg]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi]Unknown
Source package: [grub2]
Details (6)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-amd64]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-amd64-bin]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-amd64-dbg]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-amd64-signed-template]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-arm64]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-arm64-bin]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-arm64-dbg]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-arm64-signed-template]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · arm64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-ia32]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-ia32-bin]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-efi-ia32-dbg]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-emu]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm
[grub-emu-dbg]Unknown
Source package: [grub2]
Details (3)
- 2.06-13+deb12u2 · amd64 · bookworm
  Not affected
  dsa · grub2 · debian · bookworm
- 2.12-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · grub2 · debian · bookworm
- 2.06-13+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · grub2 · debian · bookworm

Next results

Observed: Oct 23, 2026, 5:58:09 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]