Summary
It was discovered that Relax-and-Recover created a world-readable initrd
when GRUB_RESCUE was enabled. A local attacker could possibly use this
issue to obtain sensitive information.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | rear | 2.6+dfsg-1+deb11u1build0.22.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | rear | 2.3+dfsg-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | rear | 2.5+dfsg-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Medium 5.5
Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local at…
References
-
report
https://ubuntu.com/security/CVE-2024-23301