Description
dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dracut | 020-1.1 | — |
| Debian 13 | dracut | 020-1.1 | — |
| Debian 12 | dracut | 020-1.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | dracut +7 | 004-336.el6 | RHSA-2013:1674 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dracut | 044-17.1 | openSUSE-SU-2024:10225-1 |
Advisories 2
- RHSA-2013:1674 Red Hat Security Advisory: dracut security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10225-1 dracut-044-17.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2013:1674 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=859448
- 55713 vdb-entry
- [oss-security] 20120927 Re: dracut creates non-world readable initramfs images mailing-list
- dracut-initramfs-information-disclosure(79258) vdb-entry
- http://git.kernel.org/?p=boot/dracut/dracut.git%3Ba=commit%3Bh=e1b48995c26c4f06d1a71
- [oss-security] 20120927 Re: dracut creates world readable initramfs images mailing-list
- [oss-security] 20120927 dracut creates non-world readable initramfs images mailing-list