PT-2024-30540 · Unknown · Calamares-Nixos-Extensions
Nintorac
+1
·
Published
2024-08-15
·
Updated
2024-08-19
·
CVE-2024-43378
CVSS v3.1
7.8
High
| Vector | AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
calamares-nixos-extensions versions prior to 0.3.17
Description
The issue affects users who installed NixOS through the graphical installer using manual disk partitioning, where the system boots via legacy BIOS, some disk partitions are encrypted, but the partitions containing
/ or /boot are unencrypted. The LUKS disk encryption key file is stored in plain text in /crypto keyfile.bin or in a CPIO archive attached to the NixOS initrd. This problem is a partial regression of a previous issue and affects the security of the system. The estimated number of potentially affected devices is not specified.Recommendations
For calamares-nixos-extensions versions prior to 0.3.17, the best solution is to back up data and perform a complete reinstallation. As a temporary workaround, consider deleting the
/crypto keyfile.bin file and following the remediation steps for the previous advisory, especially if / is unencrypted but /boot is not. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the crypto keyfile.bin file in the affected setup until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Calamares-Nixos-Extensions