SUSE-SU-2024:0291-1: Security update for rear116

Q: Who could access the exposed initrd contents?

Any local user able to read the world-readable initrd could potentially access sensitive information if it is present in that image.

Q: What configuration condition makes this relevant?

The issue is relevant where the initrd contains sensitive information and has world-readable permissions.

Q: What does the update change?

The update corrects the initrd permissions so it is no longer world-readable.

Published Jan 31, 2024

Updated

This update for rear116 fixes the following issues: CVE-2024-23301: Corrected world-readable permissions for initrd, which could be an issue if it contains sensitive information (bsc#1218728).

Affected Software

4 affected componentsFixes available

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 12 SP5 (noarch)

suse/rear116<1.16-15.3.1

1.16-15.3.1

All of the following

SUSE SUSE Linux Enterprise High Availability Extension 12 SP5 (noarch)

suse/rear116<1.16-15.3.1

1.16-15.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/rear116 to a version that resolves this vulnerability.
Fixed in 1.16-15.3.1
Upgrade
Upgrade rear116 to a version that resolves this vulnerability.
Patch SUSE-SLE-HA-12-SP5-2024-291=1

Event History

Jan 31, 2024

Advisory Published

via SUSE·04:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2024-23301

Frequently Asked Questions

Who could access the exposed initrd contents?

Any local user able to read the world-readable initrd could potentially access sensitive information if it is present in that image.

What configuration condition makes this relevant?

The issue is relevant where the initrd contains sensitive information and has world-readable permissions.

What does the update change?

The update corrects the initrd permissions so it is no longer world-readable.

SUSE-SU-2024:0291-1: Security update for rear116

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who could access the exposed initrd contents?

What configuration condition makes this relevant?

What does the update change?

Company

Resources

Contact

Frequently Asked Questions

Who could access the exposed initrd contents?

What configuration condition makes this relevant?

What does the update change?