Bug 1392056 (CVE-2016-8637)
| Summary: | CVE-2016-8637 dracut: Local information disclosure of initramfs when early cpio is used | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED NOTABUG | QA Contact: | |||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | unspecified | CC: | harald, lnykryn, security-response-team, slawomir | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 1393912 (view as bug list) | Environment: | |||||
| Last Closed: | 2019-06-08 03:01:50 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1392435, 1393912 | ||||||
| Bug Blocks: | 1392057 | ||||||
| Attachments: |
|
||||||
Acknowledgments: Name: Andreas Stieger (SUSE Security Team) Created attachment 1217453 [details]
Proposed patch
Created dracut tracking bugs for this issue: Affects: fedora-all [bug 1392435] Public via: http://seclists.org/oss-sec/2016/q4/352 |
A local information disclosure issue was found in dracut when generating initramfs images with world-readable permissions when "early cpio" is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials. Vulnerable code: if [[ $create_early_cpio = yes ]]; then echo 1 > "$early_cpio_dir/d/early_cpio" # The microcode blob is _before_ the initramfs blob, not after (cd "$early_cpio_dir/d"; find . -print0 | cpio --null $cpio_owner_root -H newc -o --quiet > $outfile) fi if ! ( umask 077; cd "$initdir"; find . -print0 | cpio --null $cpio_owner_root -H newc -o --quiet | \ $compress >> "$outfile"; ); then dfatal "dracut: creation of $outfile failed" exit 1 fi The permissions of the output file depend on umask at creation time, and appending to an existing file does not change them. create_early_cpio is set to on when microcode updates are being used.