PT-2018-5040 · Dracut+1 · Dracut+1

Andreas Stieger · Published 2016-11-17 · Updated 2024-06-15 · CVE-2016-8637

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dracut versions prior to 045

Description A local information disclosure issue was found when generating initramfs images with world-readable permissions, particularly when 'early cpio' is used, such as including microcode updates. This allows a local attacker to obtain sensitive information from these files, including encryption keys or credentials.

Recommendations For dracut versions prior to 045, update to version 045 or later to resolve the issue. As a temporary workaround, consider restricting access to initramfs images generated with 'early cpio' to minimize the risk of exploitation. Avoid using world-readable permissions when generating these images until the issue is resolved.

Exploit

Fix

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

CVE-2016-8637

MGASA-2016-0387

OPENSUSE-SU-2024:10225-1

SUSE-SU-2017:0641-1

SUSE-SU-2017:0951-1

SUSE-SU-2017:2696-1

SUSE-SU-2017_0641-1

SUSE-SU-2017_0951-1

SUSE-SU-2017_2696-1

Affected Products

Suse

Dracut

References · 46

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8637 · Exploit
• 🔥 http://seclists.org/oss-sec/2016/q4/352 · Exploit
• https://github.com/dracutdevs/dracut/commit/0db98910a11c12a454eac4c8e86dc7a7bbc764a4 · Patch
• https://security-tracker.debian.org/tracker/CVE-2016-8637 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10225-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0387 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-8637 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:0951-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8637 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/2VA7LTNATN2EKBHSSHB35W5AXITXVLG6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-8637 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8637 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8637 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0641-1 · Vendor Advisory