CVE-2016-8637

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.
References
Link Resource
http://seclists.org/oss-sec/2016/q4/352 Exploit Mailing List Third Party Advisory
http://www.securityfocus.com/bid/94128 Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8637 Exploit Issue Tracking Third Party Advisory
https://github.com/dracutdevs/dracut/commit/0db98910a11c12a454eac4c8e86dc7a7bbc764a4 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:dracut_project:dracut:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-08-01 13:29

Updated : 2024-02-04 20:03


NVD link : CVE-2016-8637

Mitre link : CVE-2016-8637

CVE.ORG link : CVE-2016-8637


JSON object : View

Products Affected

dracut_project

  • dracut
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor