CVE-2024-23301
Fixed in a distro release EPSS <1%CVSS 5.5
Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.
Products: relax-and-recover, suse linux_enterprise, redhat enterprise_linux, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | rear | 2.6-11.el8_9.alma.1 |
| AlmaLinux 9 | rear | 2.6-21.el9_3.alma |
| Amazon Linux 2 | rear | 2.00-7.amzn2.0.1 |
| Debian 10 | rear | 2.4+dfsg-1+deb10u1 |
| Debian 11 | rear | 2.6+dfsg-1+deb11u1 |
| Debian 12 | rear | 2.7+dfsg-1+deb12u1 |
| Debian 13 | rear | 2.7+dfsg-1.2 |
| Debian 14 | rear | 2.7+dfsg-1.2 |
| Red Hat Enterprise Linux 8 | rear | 0:2.6-11.el8_9 |
| Red Hat Enterprise Linux 9 | rear | 0:2.6-21.el9_3 |
| Rocky Linux 8 | rear | 0:2.6-11.el8_9 |
| SUSE Linux Enterprise High Availability Extension 12 SP5 | rear116 | 1.16-15.3.1 |
| SUSE Linux Enterprise High Availability Extension 12 SP5 | rear1172a | 1.17.2.a-5.3.1 |
| SUSE Linux Enterprise High Availability Extension 12 SP5 | rear118a | 1.18.a-9.3.1 |
| SUSE Linux Enterprise High Availability Extension 12 SP5 | rear23a | 2.3.a-3.9.1 |
| SUSE Linux Enterprise High Availability Extension 12 SP5 | rear27a | 2.7-8.6.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP1 | rear23a | 2.3.a-150000.9.9.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP2 | rear23a | 2.3.a-150000.9.9.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP2 | rear27a | 2.7-150200.5.6.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP3 | rear23a | 2.3.a-150300.21.3.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP3 | rear27a | 2.7-150200.5.6.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP4 | rear23a | 2.3.a-150300.21.3.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP4 | rear27a | 2.7-150200.5.6.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP5 | rear23a | 2.3.a-150300.21.3.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP5 | rear27a | 2.7-150500.3.3.1 |
| Ubuntu 18.04 LTS | rear | no fix |
| Ubuntu 20.04 LTS | rear | no fix |
| Ubuntu 22.04 LTS | rear | no fix |
| openSUSE Leap 15.5 | rear23a | 2.3.a-150300.21.3.1 |
| openSUSE Leap 15.5 | rear27a | 2.7-150500.3.3.1 |
| openSUSE Tumbleweed | rear | 2.7-2.1 |