Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rear | Mar 8, 2024 | Jan 12, 2024 |
| Amazon Linux Ami 2 | — | Upgrade rearUpgrade rear-debuginfo | Feb 21, 2024 | Jan 12, 2024 |
| Debian | — | Upgrade rear | Feb 12, 2024 | Jan 12, 2024 |
| Oracle_linux | — | Upgrade rear | Mar 6, 2024 | Jan 13, 2024 |
| Redhat_linux | — | No solution existsUpgrade rear | Mar 6, 2024 | Jan 12, 2024 |
| Rocky_linux | — | Upgrade rear | May 8, 2024 | Jan 12, 2024 |
| Suse | — | Upgrade rear27aUpgrade rear23a | Jan 29, 2024 | Jan 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub