CVE-2016-8637

MEDIUM5.0

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates

Published Aug 1, 2018

Modified 1 years ago

Details

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.

References

WEB

http://seclists.org/oss-sec/2016/q4/352

WEB

http://www.securityfocus.com/bid/94128

WEB

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8637

WEB

https://github.com/dracutdevs/dracut/commit/0db98910a11c12a454eac4c8e86dc7a7bbc764a4

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2016-8637

CVSS Analysis