CVE-2021-3981: 
Rocky Linux vulnerability analysis and mitigation

A flaw in GRUB2 (CVE-2021-3981) was discovered where its configuration file, known as grub.cfg, is being created with the wrong permission set (0644) allowing non-privileged users to read its content. This vulnerability affects GRUB2 version 2.06 and previous versions (CVE Details, Red Hat CVE).

The vulnerability stems from incorrect permission settings in the GRUB2 configuration file (grub.cfg). When the file is created, it is set with permissions that allow unprivileged users to read its contents, representing a low severity confidentiality issue. The issue was fixed in GRUB upstream through a patch that restores the proper umask for grub.cfg (Red Hat Bugzilla, Fedora Update).

The primary impact of this vulnerability is that unauthorized users can read the grub.cfg file content, which may contain encrypted passwords. This represents a low severity confidentiality issue as those users can potentially access any encrypted passwords present in the configuration file (CVE Details).

The issue has been fixed in the GRUB upstream through a patch that restores the proper umask for grub.cfg. Users are advised to upgrade to patched versions of GRUB2. For Fedora users, the fix is available in version 2.06-9.fc34, and for Gentoo users, versions >= 2.06 contain the fix (Fedora Update, Gentoo Security).