CVE-2016-8637

CVSS V2 Low 2.1 CVSS V3 High 7.8
Description
A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.
Overview
  • CVE ID
  • CVE-2016-8637
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2018-08-01T13:29:00
  • Last Modified Date
  • 2023-02-12T23:26:16
Weakness Enumerations
CWE URL
CWE-732 http://cwe.mitre.org/data/definitions/732.html
CWE-200 http://cwe.mitre.org/data/definitions/200.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:dracut_project:dracut:*:*:*:*:*:*:*:* 1 OR 045
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:L/Au:N/C:P/I:N/A:N
  • Access Vector
  • LOCAL
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 2.1
  • Severity
  • LOW
  • Exploitability Score
  • 3.9
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector
  • LOCAL
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 7.8
  • Base Severity
  • HIGH
  • Exploitability Score
  • 1.8
  • Impact Score
  • 5.9
References
Reference URL Reference Tags
https://github.com/dracutdevs/dracut/commit/0db98910a11c12a454eac4c8e86dc7a7bbc764a4 Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8637 Exploit Issue Tracking Third Party Advisory
http://seclists.org/oss-sec/2016/q4/352 Exploit Mailing List Third Party Advisory
http://www.securityfocus.com/bid/94128 Third Party Advisory VDB Entry
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2016-8637
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8637
History
Created Old Value New Value Data Type Notes
2022-05-10 17:13:51 Added to TrackCVE
2022-12-03 10:46:42 2018-08-01T13:29Z 2018-08-01T13:29:00 CVE Published Date updated
2022-12-03 10:46:42 2019-10-09T23:20:07 CVE Modified Date updated
2022-12-03 10:46:42 Modified Vulnerability Status updated
2023-02-13 01:08:25 2023-02-12T23:26:16 CVE Modified Date updated
2023-02-13 01:08:26 Weakness Enumeration update