CVE-2024-23301: Medium severity Relax-and-Recover Relax-and-Recover vulnerability
Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUBRESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23301?
CVE-2024-23301 is considered a high severity vulnerability due to its potential to expose sensitive system secrets to local attackers.
How do I fix CVE-2024-23301?
To fix CVE-2024-23301, update Relax-and-Recover to the latest version that addresses the issue or adjust your GRUB configuration to prevent creating world-readable initrd files.
What systems are affected by CVE-2024-23301?
CVE-2024-23301 affects Relax-and-Recover versions up to 2.7 as well as specific versions of SUSE Linux Enterprise, Red Hat Enterprise Linux, and Fedora.
Can local attackers exploit CVE-2024-23301?
Yes, local attackers can exploit CVE-2024-23301 by gaining unauthorized access to sensitive information in the world-readable initrd.
Is there a public discussion about CVE-2024-23301?
Yes, CVE-2024-23301 has been discussed in various online forums and GitHub repositories, providing insights into its impact and fixes.