Relax-and-Recover (aka ReaR) up to and including 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local malicious users to gain access to system secrets otherwise only readable by root.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
relax-and-recover relax-and-recover |
||
suse linux enterprise 15.0 |
||
redhat enterprise linux 8.0 |
||
redhat enterprise linux 9.0 |
||
fedoraproject fedora 39 |
Vulmon