A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.

This update for dracut fixes the following issues: Security issues fixed :

  - CVE-2016-8637: When the early microcode loading was     enabled during initrd creation, the initrd would be     read-only available for all users, allowing local users     to retrieve secrets stored in the initial ramdisk.
    (bsc#1008340) Non-security issues fixed :

  - Skip iBFT discovery for qla4xxx flashnode session.
    (bsc#935320)

  - Set MTU and LLADDR for DHCP if specified. (bsc#959803)

  - Allow booting from degraded MD arrays with systemd.
    (bsc#1017695)

  - Start multipath services before local-fs-pre.target.
    (bsc#1005410, bsc#1006118, bsc#1007925, bsc#986734,     bsc#986838)

  - Fixed /sbin/installkernel to handle kernel packages     built with 'make bin-rpmpkg'. (bsc#1008648)

  - Fixed typo in installkernel script. (bsc#1032576)

  - Fixed subnet calculation in mkinitrd. (bsc#1035743)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dracut fixes the following issues :

Security issues fixed :

  - CVE-2016-8637: When the early microcode loading was     enabled during initrd creation, the initrd would be     read-only available for all users, allowing local users     to retrieve secrets stored in the initial ramdisk.
    (bsc#1008340)

Non security issues fixed :

  - Remove zlib module as requirement. (bsc#1020063)

  - Unlimit TaskMax for xfs_repair in emergency shell.
    (bsc#1019938)

  - Resolve symbolic links for -i and -k parameters.
    (bsc#902375)

  - Enhance purge-kernels script to handle kgraft patches.
    (bsc#1017141)

  - Allow booting from degraded MD arrays with systemd.
    (bsc#1017695)

  - Allow booting on s390x with fips=1 on the kernel command     line. (bnc#1021687)

  - Start multipath services before local-fs-pre.target.
    (bsc#1005410, bsc#1006118, bsc#1007925)

  - Fix /sbin/installkernel to handle kernel packages built     with 'make bin-rpmpkg'. (bsc#1008648)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for dracut fixes the following issues: Security issues fixed :

  - CVE-2016-8637: When the early microcode loading was     enabled during initrd creation, the initrd would be     read-only available for all users, allowing local users     to retrieve secrets stored in the initial ramdisk.
    (bsc#1008340) Non security issues fixed :

  - Remove zlib module as requirement. (bsc#1020063)

  - Unlimit TaskMax for xfs_repair in emergency shell.
    (bsc#1019938)

  - Resolve symbolic links for -i and -k parameters.
    (bsc#902375)

  - Enhance purge-kernels script to handle kgraft patches.
    (bsc#1017141)

  - Allow booting from degraded MD arrays with systemd.
    (bsc#1017695)

  - Allow booting on s390x with fips=1 on the kernel command     line. (bnc#1021687)

  - Start multipath services before local-fs-pre.target.
    (bsc#1005410, bsc#1006118, bsc#1007925)

  - Fix /sbin/installkernel to handle kernel packages built     with 'make bin-rpmpkg'. (bsc#1008648)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dracut fixes the following issues :

Security issues fixed :

  - CVE-2016-8637: When the early microcode loading was     enabled during initrd creation, the initrd would be     read-only available for all users, allowing local users     to retrieve secrets stored in the initial ramdisk.
    (bsc#1008340)

Non security issues fixed :

  - Allow booting from degraded MD arrays with systemd.
    (bsc#1017695)

  - Start multipath services before local-fs-pre.target.
    (bsc#1005410, bsc#1006118, bsc#1007925, bsc#986734,     bsc#986838)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for dracut fixes the following issues: Security issues fixed :

  - CVE-2016-8637: When the early microcode loading was     enabled during initrd creation, the initrd would be     read-only available for all users, allowing local users     to retrieve secrets stored in the initial ramdisk.
    (bsc#1008340) Non security issues fixed :

  - Allow booting from degraded MD arrays with systemd.
    (bsc#1017695)

  - Start multipath services before local-fs-pre.target.
    (bsc#1005410, bsc#1006118, bsc#1007925, bsc#986734,     bsc#986838)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fixed permissions of initramfs file, if microcode is     prepended (CVE-2016-8637)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
103771	SUSE SLES12 Security Update : dracut (SUSE-SU-2017:2696-1)	Nessus	SuSE Local Security Checks	high
99450	openSUSE Security Update : dracut (openSUSE-2017-482)	Nessus	SuSE Local Security Checks	high
99244	SUSE SLED12 / SLES12 Security Update : dracut (SUSE-SU-2017:0951-1)	Nessus	SuSE Local Security Checks	high
97790	openSUSE Security Update : dracut (openSUSE-2017-347)	Nessus	SuSE Local Security Checks	high
97655	SUSE SLED12 / SLES12 Security Update : dracut (SUSE-SU-2017:0641-1)	Nessus	SuSE Local Security Checks	high
95014	Fedora 25 : dracut (2016-cc5006bef7)	Nessus	Fedora Local Security Checks	high
94659	Fedora 24 : dracut (2016-94d1c64fe2)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2016-8637

high

Tenable Plugins

high

high

high

high

high

high

high