Description
The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | kdump | 0.8.15-29.1 | SUSE-SU-2016:2553-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | kdump | 0.8.15-29.1 | SUSE-SU-2016:2553-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kdump | 0.9.1-3.2 | openSUSE-SU-2024:10892-1 |
Advisories 2
- openSUSE-SU-2024:10892-1 kdump-0.9.1-3.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2553-1 Security update for kdump SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [sle-security-updates] 20161017 SUSE-SU-2016:2553-1: moderate: Security update for kdump mailing-list
- openSUSE-SU-2016:2605 vendor-advisory