dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.

It was discovered that dracut created initramfs images as world readable. A local user could possibly use this flaw to obtain sensitive information from these files, such as iSCSI authentication passwords, encrypted root file system crypttab passwords, or other information. (CVE-2012-4453)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1674 advisory.

    [004-336.0.1]
    - do not strip modules with signatures. [orabug 17458249] (Jerry Snitselaar)
    - scsi_wait module removed in 3.8. Mute errors. [orabug 16977193] (Maxim Uvarov)       find firmware in /lib/modules/firmware/2.6.32-400.1.1.el5uek first       and /lib/modules/firmware second (<maxim.uvarov@oracle.com)       Resolves: Orabug: 13351090
    - Fix btrfs discovery [orabug 13388545]

    [004-336]
    - install /etc/system-fips in the initramfs     Resolves: rhbz#1012626

    [004-335]
    - fixed interface renaming     Resolves: rhbz#1019104

    [004-334]
    - fcoe: add --link-retry=100 to fipvlan call     Resolves: rhbz#1012316
    - ldd: redirect error to /dev/null
    - do not turn off biosdevname, if not given on kernel cmdline     Resolves: rhbz#1011508
    - network: fixed ibft parsing     Resolves: rhbz#1011508

    [004-330]
    - changed /etc/redhat-fips to /etc/system-fips     Resolves: rhbz#1012626

    [004-329]
    - add /etc/redhat-fips     Resolves: rhbz#1012626

    [004-328]
    - fixed crypt: add support for keyfiles in the initramfs     Resolves: rhbz#886194

    [004-327]
    - fixed crypt: add support for keyfiles in the initramfs     Resolves: rhbz#886194
    - fixed booting with iSCSI and without network config     Resolves: rhbz#910605

    [004-322]
    - fixed crypt: add support for keyfiles in the initramfs     Resolves: rhbz#886194
    - fixed FIPS module checking     Resolves: rhbz#947729

    [004-316]
    - create the initramfs non-world readable
    - unset LD_LIBRARY_PATH and GREP_OPTIONS     Resolves: rhbz#912299
    - add mkinitrd man page     Resolves: rhbz#610462
    - add bonding     Resolves: rhbz#851666
    - lvm: add '--yes' to lvchange     Resolves: rhbz#720684
    - crypt: add support for keyfiles in the initramfs     Resolves: rhbz#886194
    - start iscsi regardless of network, if requested     Resolves: rhbz#813687
    - install multipath module only, when root is multipath in generic mode     Resolves: rhbz#916144
    - fips: handle checksum checks for RHEV kernels     Resolves: rhbz#947729
    - add xhci-hcd driver     Resolves: rhbz#960729

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated dracut packages that fix one security issue, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The dracut packages include an event-driven initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.

It was discovered that dracut created initramfs images as world readable. A local user could possibly use this flaw to obtain sensitive information from these files, such as iSCSI authentication passwords, encrypted root file system crypttab passwords, or other information. (CVE-2012-4453)

This issue was discovered by Peter Jones of the Red Hat Installer Team.

These updated dracut packages include numerous bug fixes and two enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All dracut users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

- fixed ifup exit code

    - fixed default 'rd.auto' parameter setting

    - only 'warn' not 'error', if we don't strip the       initramfs

    - do not overwrite ifcfg from anaconda

    - ssh-client module fixes

    - strip binaries in the initramfs by default now

    - fixes for systemd and crypto

    - new dracut kernel command line options 'rd.auto'

    - new dracut kernel command line options       'rd.noverifyssl'

    - new dracut option '--kernel-cmdline' and       'kernel_cmdline' option for default parameters

    - fix for kexec in shutdown, if not included in       initramfs

  - no more iscsi_wait_scan

    - curl: give info what URL failed, support https

    - use findmnt

    - systemd: wait for crypto target

    - only install crypttab in host-only mode

    - add udev groups

    - fixed busybox install

    - fixed rd.luks.allow-discards manpage and handling

    - force install dm_mod

    - do not create the initramfs world reabable

    - add nameserver even for dhcp

    - fallback to reboot if shutdown was called without a       parameter

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

dracut-018-60.git20120927

  - run dracut-shutdown.service before shutdown.target     Resolves: rhbz#840120

  - do not create the initramfs world readable Resolves:
    rhbz#859448

  - mdraid: do the dracut shutdown, if a md raid is found

    - mdraid: handle nested md raids

    - mdraid: wait until devices are clean on shutdown       Resolves: rhbz#732297 rhbz#840562

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

dracut-018-105.git20120927

  - enable the use of the nbd port with e.g. '-N ltsp'

    - actually make reset_overlay working for squash       overlays

    - fixed FIPS

    - if any mdraid found, make dracut run on shutdown

    - make the initramfs non-world readable

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
71397	Amazon Linux AMI : dracut (ALAS-2013-257)	Nessus	Amazon Linux Local Security Checks	low
71297	Scientific Linux Security Update : dracut on SL6.x (noarch) (20131121)	Nessus	Scientific Linux Local Security Checks	low
71111	Oracle Linux 6 : dracut (ELSA-2013-1674)	Nessus	Oracle Linux Local Security Checks	medium
71016	RHEL 6 : dracut (RHSA-2013:1674)	Nessus	Red Hat Local Security Checks	low
62698	Fedora 18 : dracut-024-5.git20121019.fc18 (2012-16448)	Nessus	Fedora Local Security Checks	low
62526	Fedora 16 : dracut-018-60.git20120927.fc16 (2012-14959)	Nessus	Fedora Local Security Checks	low
62525	Fedora 17 : dracut-018-105.git20120927.fc17 (2012-14953)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2012-4453

medium

Tenable Plugins

low

low

medium

low

low

low

low