CVE-2016-8637: Infoleak
A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dracutto a version that resolves this vulnerability.Fixed in 059-4Fixed in 106-6Fixed in 112-6 - Upgrade
Upgrade
dracutto a version that resolves this vulnerability.Fixed in 045
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8637?
CVE-2016-8637 is considered a local information disclosure vulnerability.
How do I fix CVE-2016-8637?
To fix CVE-2016-8637, upgrade Dracut to version 045 or later.
Who is affected by CVE-2016-8637?
CVE-2016-8637 affects users of Dracut versions before 045 that generate initramfs images.
What type of information can be disclosed in CVE-2016-8637?
CVE-2016-8637 can disclose sensitive information such as encryption keys from world-readable initramfs images.
What is Dracut in the context of CVE-2016-8637?
Dracut is an application used to create initramfs images in Linux systems, and CVE-2016-8637 pertains to its improper permissions.