PT-2024-1137 · Unknown+7 · Relax-And-Recover+7
Jsmeix
·
Published
2024-01-12
·
Updated
2025-12-10
·
CVE-2024-23301
CVSS v2.0
6.8
Medium
| Vector | AV:L/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Relax-and-Recover (aka ReaR) versions 2.7 and earlier
Description
The issue is related to information disclosure. It allows local attackers to gain access to system secrets that are otherwise only readable by root. This occurs when using GRUB RESCUE=y, which creates a world-readable initrd.
Recommendations
For Relax-and-Recover (aka ReaR) versions 2.7 and earlier, consider disabling the use of GRUB RESCUE=y until a patch is available to prevent the creation of a world-readable initrd. As a temporary workaround, restrict access to sensitive system secrets to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Incorrect Default Permissions
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Red Hat
Red Os
Relax-And-Recover
Rocky Linux
Suse