UBUNTU-CVE-2024-23301: Medium severity ubuntu/rear vulnerability
Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUBRESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker with low-level privileges can exploit it if ReaR is configured with GRUB_RESCUE=y and has created the affected initrd. Remote, unauthenticated attackers are not indicated by the supplied severity vector.
What configuration is required for exposure?
The issue occurs when Relax-and-Recover is used with GRUB_RESCUE=y. The data does not state that this setting is enabled by default.
What information could be exposed?
The world-readable initrd can expose system secrets that would otherwise be readable only by root. The supplied data does not identify specific secret types.
How can I check whether a system may be affected?
Check whether the installed ReaR version is through 2.7, whether GRUB_RESCUE=y is configured, and whether generated initrd files are world-readable.