Published: 09/10/2012 Updated: 13/02/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.

Vulnerable Product	Search on Vulmon	Subscribe to Product
dracut project dracut
fedoraproject fedora 17
fedoraproject fedora 16
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0

Synopsis Moderate: dracut security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic Updated dracut packages that fix one security issue, several bugs, and addtwo enhancements are now available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this up ...

Debian Bug report logs - #688956 dracut: CVE-2012-4453: creates non-world readable initramfs images Package: dracut; Maintainer for dracut is Thomas Lange <lange@debianorg>; Source for dracut is src:dracut (PTS, buildd, popcon) Reported by: Henri Salo <henri@nervfi> Date: Thu, 27 Sep 2012 11:36:01 UTC Severity: im ...

It was discovered that dracut created initramfs images as world readable A local user could possibly use this flaw to obtain sensitive information from these files, such as iSCSI authentication passwords, encrypted root file system crypttab passwords, or other information (CVE-2012-4453) ...

CWE-276 http://www.openwall.com/lists/oss-security/2012/09/27/4 http://www.openwall.com/lists/oss-security/2012/09/27/6 https://bugzilla.redhat.com/show_bug.cgi?id=859448 http://www.openwall.com/lists/oss-security/2012/09/27/3 http://www.securityfocus.com/bid/55713 http://rhn.redhat.com/errata/RHSA-2013-1674.html https://exchange.xforce.ibmcloud.com/vulnerabilities/79258 http://git.kernel.org/?p=boot/dracut/dracut.git%3Ba=commit%3Bh=e1b48995c26c4f06d1a71 https://access.redhat.com/errata/RHSA-2013:1674 https://nvd.nist.gov https://alas.aws.amazon.com/ALAS-2013-257.html

CVE-2012-4453

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect