CVE-2008-3895: Infoleak
LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3895?
CVE-2008-3895 is considered to be of high severity due to the potential exposure of sensitive authentication information.
How do I fix CVE-2008-3895?
To fix CVE-2008-3895, upgrade to a version of LILO that is more recent than 22.6.1, as this vulnerability has been addressed in later releases.
What are the impacts of CVE-2008-3895?
The impact of CVE-2008-3895 allows local users to access sensitive information stored in the BIOS keyboard buffer, potentially compromising system security.
Who is affected by CVE-2008-3895?
CVE-2008-3895 affects all versions of LILO up to and including 22.6.1.
Is there a workaround for CVE-2008-3895?
There are no known workarounds for CVE-2008-3895, and the recommended action is to upgrade to a secure version.