vulnwire
5.0med

CVE-2016-8637

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when '…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.0
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 24%
Public exploits
0
none known

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.

Exploit prediction (EPSS)

0.31% probability of exploitation in the next 30 days, higher than 24% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.05.0CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CNA3.05.0CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
NVD3.07.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • The Dracut Project dracut

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2016-8637 · x_refsource_CONFIRM, x_transferred
  • github.com /dracutdevs/dracut/commit/0db98910a11c12a454eac4c8e86dc7a7bbc764a4 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/94128 · vdb-entry, x_refsource_BID, x_transferred
  • seclists.org /oss-sec/2016/q4/352 · mailing-list, x_refsource_MLIST, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.