CVE-2024-23301: Medium severity Relax-and-Recover Relax-and-Recover vulnerability
Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUBRESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rearto a version that resolves this vulnerability.Fixed in 2.7+dfsg-1+deb12u1 - Upgrade
Upgrade
debian/rearto a version that resolves this vulnerability.Fixed in 2.7+dfsg-1.2 - Upgrade
Upgrade
debian/rearto a version that resolves this vulnerability.Fixed in 2.7+dfsg-1+deb12u1Fixed in 2.7+dfsg-1.2Fixed in 2.9+dfsg-3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23301?
CVE-2024-23301 is considered a high severity vulnerability due to its potential to expose sensitive system secrets to local attackers.
How do I fix CVE-2024-23301?
To fix CVE-2024-23301, update Relax-and-Recover to the latest version that addresses the issue or adjust your GRUB configuration to prevent creating world-readable initrd files.
What systems are affected by CVE-2024-23301?
CVE-2024-23301 affects Relax-and-Recover versions up to 2.7 as well as specific versions of SUSE Linux Enterprise, Red Hat Enterprise Linux, and Fedora.
Can local attackers exploit CVE-2024-23301?
Yes, local attackers can exploit CVE-2024-23301 by gaining unauthorized access to sensitive information in the world-readable initrd.
Is there a public discussion about CVE-2024-23301?
Yes, CVE-2024-23301 has been discussed in various online forums and GitHub repositories, providing insights into its impact and fixes.