PT-2023-25585 · Unknown · Calamares-Nixos-Extensions

Jonathonhall-Purism + 3 · Publicado 2023-06-29 · Atualizado 2024-08-16 · CVE-2023-36476

Positive Technologies (AI Summary)

CVSS v3.1

7.9

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions calamares-nixos-extensions versions 0.3.12 and prior

Description The issue affects users of calamares-nixos-extensions who installed NixOS through the graphical calamares installer with an unencrypted /boot, on either non-UEFI systems or with a LUKS partition different from /. In these cases, the LUKS key file is stored in /boot as a plaintext CPIO archive attached to the NixOS initrd. A patch is anticipated to be part of version 0.3.13.

Recommendations For versions 0.3.12 and prior, expert users can re-encrypt the LUKS partition(s) themselves as a workaround. Update to version 0.3.13 or later when available to apply the patch.

Exploit

Correção

Insufficiently Protected Credentials

Information Disclosure

Enumeração de Fraquezas

CWE-522

CWE-200

Identificadores relacionados

CVE-2023-36476

GHSA-3RVF-24Q2-24WW

Produtos afetados

Calamares-Nixos-Extensions

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36476.json · Exploit
• 🔥 https://github.com/osresearch/heads/issues/1348 · Exploit
• https://github.com/NixOS/calamares-nixos-extensions/security/advisories/GHSA-3rvf-24q2-24ww · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-36476 · Aviso do Fabricante
• https://t.me/cvedetector/3317 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-36476 · Nota de Segurança
• https://github.com/vlinkz/calamares-nixos-extensions/commit/837ca4da5521a74d3b5ca6f7b88890a6713faa22 · Correção
• https://t.me/cvenotify/90863 · Publicação no Telegram