Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2024:1719 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1719 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-1719 advisory.

    [2.6-11.0.1]
    - Change OS_VENDOR to OracleServer

    [2.6-11]
    - make initrd accessible only by root (CVE-2024-23301), PR 3123

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1719 advisory.

    Relax-and-Recover is a recovery and system migration utility. The utility produces a bootable image and     restores from backup using this image. It allows to restore to different hardware and can therefore be     also used as a migration utility.

    Security Fix(es):

    * rear: creates a world-readable initrd (CVE-2024-23301)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1147 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-1147 advisory.

    [2.6-21.0.1]
    - rear: creates a world-readable initrd (CVE-2024-23301)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1147 advisory.

    Relax-and-Recover is a recovery and system migration utility. The utility produces a bootable image and     restores from backup using this image. It allows to restore to different hardware and can therefore be     also used as a migration utility.

    Security Fix(es):

    * rear: creates a world-readable initrd (CVE-2024-23301)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0657-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a2f6e5ddb8 advisory.

    * Fri Feb  9 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-8
    - Sync with patches in CentOS Stream 9 (kudos to @pcahyna!) chronologically       from the latest:
      - Resolve libs for executable links in COPY_AS_IS, PR 3073
      - Skip invalid disk drives when saving layout PR 3047
      - Do not delete NetBackup logs in case of errors and save         /usr/openv/netbackup/logs to the restored system after a successful recovery
      - Add /usr/openv/var to COPY_AS_IS_NBU, fixes an issue seen         with NetBackup 10.2.0.1
      - Support saving and restoring hybrid BIOS/UEFI bootloader, PRs 3145 3136
    * Thu Feb  8 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-7
    - do not generate /etc/rear/os.conf during build
    * Wed Feb  7 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-6
    - copy the console= kernel arguments from the original system
    * Tue Feb  6 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-5
    - replace dhcp-client with dhcpcd (rhbz#2247060)
    * Tue Feb  6 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-4
    - make initrd accessible only by root (CVE-2024-23301)
    * Tue Feb  6 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-3
    - fix unusable recovery with newer systemd (rbhz#2254871)
    * Mon Feb  5 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-2
    - migrate to SPDX license format
    - properly use %license and %doc macros
    - use https in URLs
    * Fri Feb  2 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-1
    - rebase to version 2.7 (rhbz#2215778)
    - drop obsolete patches
    - rebase remaining patches
    * Fri Feb  2 2024 Luk Zaoral <lzaoral@redhat.com> - 2.6-14
    - Sync with patches in CentOS Stream 9 (kudos to @pcahyna!) chronologically       from the latest:
      - Backport PR 3061 to save LVM pool metadata volume size in disk layout         and restore it
      - Backport PR 3058 to skip useless xfs mount options when mounting         during recovery, prevents mount errors like logbuf size must be greater         than or equal to log stripe size
      - Add patch to force removal of lvmdevices, prevents LVM problems after         restoring to different disks/cloning. Upstream PR 3043
      - Add patch to start rsyslog and include NBU systemd units
      - Apply PR 3027 to ensure correct creation of the rescue environment         when a file is shrinking while being read
      - Backport PR 2774 to increase USB_UEFI_PART_SIZE to 1024 MiB
      - Apply upstream patch for temp dir usage with LUKS to ensure         that during recovery an encrypted disk can be unlocked using a keyfile
      - Backport upstream PR 3031: Secure Boot support for OUTPUT=USB
      - Correct a mistake done when backporting PR 2691
      - Backport PR2943 to fix s390x dasd formatting
      - Require s390utils-{core,base} on s390x
      - Apply PR2903 to protect against colons in pvdisplay output
      - Apply PR2873 to fix initrd regeneration on s390x
      - Apply PR2431 to migrate XFS configuration files
      - Exclude /etc/lvm/devices from the rescue system to work around a segfault         in lvm pvcreate
      - Avoid stderr message about irrelevant broken links
      - Changes for NetBackup (NBU) 9.x support
      - Backport PR2831 - rsync URL refactoring         fixes rsync OUTPUT_URL when different from BACKUP_URL
      - Apply PR2795 to detect changes in system files between backup         and rescue image
      - Apply PR2808 to exclude dev/watchdog* from recovery system
      - Backport upstream PRs 2827 and 2839 to pass -y to lvcreate instead of one y         on stdin
      - Apply PR2811 to add the PRE/POST_RECOVERY_COMMANDS directives
      - Recommend dosfstools on x86_64, needed for EFI System Partition
      - Backport PR2825 to replace defunct mkinitrd with dracut
      - Apply PR2580 to load the nvram module in the rescue environment in order         to be able to set the boot order on ppc64le LPARs
      - Backport PR2822 to include the true vi executable in rescue ramdisk
      - Apply PR2675 to fix leftover temp dir bug (introduced in backported PR2625)
      - Apply PR2603 to ignore unused PV devices
      - Apply upstream PR2750 to avoid exclusion of wanted multipath devices
      - Remove unneeded xorriso dep on s390x (no ISO image support there)
      - Apply upstream PR2736 to add the EXCLUDE_{IP_ADDRESSES,NETWORK_INTERFACES}         options
      - Add patch for better handling of thin pools and other LV types not supported         by vgcfgrestore
      - Sync spec changes and downstream patches from RHEL 8 rear-2.6-2
        - Fix multipath performance regression in 2.6, introduced by upstream PR #2299.
          Resolves: rhbz1993296
        - On POWER add bootlist & ofpathname to the list of required programs           conditionally (bootlist only if running under PowerVM, ofpathname           always except on PowerNV) - upstream PR2665, add them to package           dependencies           Resolves: rhbz1983013
        - Backport PR2608:
          Fix setting boot path in case of UEFI partition (ESP) on MD RAID           Resolves: rhbz1945869
        - Backport PR2625           Prevents accidental backup removal in case of errors           Resolves: rhbz1958247
        - Fix rsync error and option handling           Resolves: rhbz1930662
      - Put TMPDIR on /var/tmp by default, otherwise it may lack space         RHBZ #1988420, upstream PR2664
      - Sync spec changes and downstream patches from RHEL 8
        - Require xorriso instead of genisoimage
        - Add S/390 support and forgotten dependency on the file utility
        - Backport upstream code related to LUKS2 support
        - Modify the cron command to avoid an e-mail with error message after           ReaR is installed but not properly configured when the cron command           is triggered for the first time
        - Changes for NetBackup (NBU) support, upstream PR2544
      - Add dependency on dhcp-client, RHBZ #1926451


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-49ddbf447d advisory.

    * Fri Feb  9 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-8
    - Sync with patches in CentOS Stream 9 (kudos to @pcahyna!) chronologically       from the latest:
      - Resolve libs for executable links in COPY_AS_IS, PR 3073
      - Skip invalid disk drives when saving layout PR 3047
      - Do not delete NetBackup logs in case of errors and save         /usr/openv/netbackup/logs to the restored system after a successful recovery
      - Add /usr/openv/var to COPY_AS_IS_NBU, fixes an issue seen         with NetBackup 10.2.0.1
      - Support saving and restoring hybrid BIOS/UEFI bootloader, PRs 3145 3136
    * Thu Feb  8 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-7
    - do not generate /etc/rear/os.conf during build
    * Wed Feb  7 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-6
    - copy the console= kernel arguments from the original system
    * Tue Feb  6 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-5
    - replace dhcp-client with dhcpcd (rhbz#2247060)
    * Tue Feb  6 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-4
    - make initrd accessible only by root (CVE-2024-23301)
    * Tue Feb  6 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-3
    - fix unusable recovery with newer systemd (rbhz#2254871)
    * Mon Feb  5 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-2
    - migrate to SPDX license format
    - properly use %license and %doc macros
    - use https in URLs
    * Fri Feb  2 2024 Luk Zaoral <lzaoral@redhat.com> - 2.7-1
    - rebase to version 2.7 (rhbz#2215778)
    - drop obsolete patches
    - rebase remaining patches
    * Fri Feb  2 2024 Luk Zaoral <lzaoral@redhat.com> - 2.6-14
    - Sync with patches in CentOS Stream 9 (kudos to @pcahyna!) chronologically       from the latest:
      - Backport PR 3061 to save LVM pool metadata volume size in disk layout         and restore it
      - Backport PR 3058 to skip useless xfs mount options when mounting         during recovery, prevents mount errors like logbuf size must be greater         than or equal to log stripe size
      - Add patch to force removal of lvmdevices, prevents LVM problems after         restoring to different disks/cloning. Upstream PR 3043
      - Add patch to start rsyslog and include NBU systemd units
      - Apply PR 3027 to ensure correct creation of the rescue environment         when a file is shrinking while being read
      - Backport PR 2774 to increase USB_UEFI_PART_SIZE to 1024 MiB
      - Apply upstream patch for temp dir usage with LUKS to ensure         that during recovery an encrypted disk can be unlocked using a keyfile
      - Backport upstream PR 3031: Secure Boot support for OUTPUT=USB
      - Correct a mistake done when backporting PR 2691
      - Backport PR2943 to fix s390x dasd formatting
      - Require s390utils-{core,base} on s390x
      - Apply PR2903 to protect against colons in pvdisplay output
      - Apply PR2873 to fix initrd regeneration on s390x
      - Apply PR2431 to migrate XFS configuration files
      - Exclude /etc/lvm/devices from the rescue system to work around a segfault         in lvm pvcreate
      - Avoid stderr message about irrelevant broken links
      - Changes for NetBackup (NBU) 9.x support
      - Backport PR2831 - rsync URL refactoring         fixes rsync OUTPUT_URL when different from BACKUP_URL
      - Apply PR2795 to detect changes in system files between backup         and rescue image
      - Apply PR2808 to exclude dev/watchdog* from recovery system
      - Backport upstream PRs 2827 and 2839 to pass -y to lvcreate instead of one y         on stdin
      - Apply PR2811 to add the PRE/POST_RECOVERY_COMMANDS directives
      - Recommend dosfstools on x86_64, needed for EFI System Partition
      - Backport PR2825 to replace defunct mkinitrd with dracut
      - Apply PR2580 to load the nvram module in the rescue environment in order         to be able to set the boot order on ppc64le LPARs
      - Backport PR2822 to include the true vi executable in rescue ramdisk
      - Apply PR2675 to fix leftover temp dir bug (introduced in backported PR2625)
      - Apply PR2603 to ignore unused PV devices
      - Apply upstream PR2750 to avoid exclusion of wanted multipath devices
      - Remove unneeded xorriso dep on s390x (no ISO image support there)
      - Apply upstream PR2736 to add the EXCLUDE_{IP_ADDRESSES,NETWORK_INTERFACES}         options
      - Add patch for better handling of thin pools and other LV types not supported         by vgcfgrestore
      - Sync spec changes and downstream patches from RHEL 8 rear-2.6-2
        - Fix multipath performance regression in 2.6, introduced by upstream PR #2299.
          Resolves: rhbz1993296
        - On POWER add bootlist & ofpathname to the list of required programs           conditionally (bootlist only if running under PowerVM, ofpathname           always except on PowerNV) - upstream PR2665, add them to package           dependencies           Resolves: rhbz1983013
        - Backport PR2608:
          Fix setting boot path in case of UEFI partition (ESP) on MD RAID           Resolves: rhbz1945869
        - Backport PR2625           Prevents accidental backup removal in case of errors           Resolves: rhbz1958247
        - Fix rsync error and option handling           Resolves: rhbz1930662
      - Put TMPDIR on /var/tmp by default, otherwise it may lack space         RHBZ #1988420, upstream PR2664
      - Sync spec changes and downstream patches from RHEL 8
        - Require xorriso instead of genisoimage
        - Add S/390 support and forgotten dependency on the file utility
        - Backport upstream code related to LUKS2 support
        - Modify the cron command to avoid an e-mail with error message after           ReaR is installed but not properly configured when the cron command           is triggered for the first time
        - Changes for NetBackup (NBU) support, upstream PR2544
      - Add dependency on dhcp-client, RHBZ #1926451


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of rear installed on the remote host is prior to 2.00-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2451 advisory.

    Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3733 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0291-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0292-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0253-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0247-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0239-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0190-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0148-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0135-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195001	Rocky Linux 8 : rear (RLSA-2024:1719)	Nessus	Rocky Linux Local Security Checks	medium
193166	AlmaLinux 8 : rear (ALSA-2024:1719)	Nessus	Alma Linux Local Security Checks	medium
193162	Oracle Linux 8 : rear (ELSA-2024-1719)	Nessus	Oracle Linux Local Security Checks	medium
193112	RHEL 8 : rear (RHSA-2024:1719)	Nessus	Red Hat Local Security Checks	medium
191690	AlmaLinux 9 : rear (ALSA-2024:1147)	Nessus	Alma Linux Local Security Checks	medium
191644	Oracle Linux 9 : rear (ELSA-2024-1147)	Nessus	Oracle Linux Local Security Checks	medium
191574	RHEL 9 : rear (RHSA-2024:1147)	Nessus	Red Hat Local Security Checks	medium
191133	SUSE SLES15 / openSUSE 15 Security Update : rear27a (SUSE-SU-2024:0657-1)	Nessus	SuSE Local Security Checks	medium
190824	Fedora 39 : rear (2024-a2f6e5ddb8)	Nessus	Fedora Local Security Checks	medium
190823	Fedora 38 : rear (2024-49ddbf447d)	Nessus	Fedora Local Security Checks	medium
190017	Amazon Linux 2 : rear (ALAS-2024-2451)	Nessus	Amazon Linux Local Security Checks	medium
189974	Debian dla-3733 : rear - security update	Nessus	Debian Local Security Checks	medium
189878	SUSE SLES12 Security Update : rear116 (SUSE-SU-2024:0291-1)	Nessus	SuSE Local Security Checks	medium
189877	SUSE SLES12 Security Update : rear1172a (SUSE-SU-2024:0292-1)	Nessus	SuSE Local Security Checks	medium
189720	SUSE SLES15 Security Update : rear27a (SUSE-SU-2024:0253-1)	Nessus	SuSE Local Security Checks	medium
189713	SUSE SLES15 / openSUSE 15 Security Update : rear23a (SUSE-SU-2024:0247-1)	Nessus	SuSE Local Security Checks	medium
189711	SUSE SLES15 Security Update : rear23a (SUSE-SU-2024:0239-1)	Nessus	SuSE Local Security Checks	medium
189399	SUSE SLES12 Security Update : rear118a (SUSE-SU-2024:0190-1)	Nessus	SuSE Local Security Checks	medium
189230	SUSE SLES12 Security Update : rear23a (SUSE-SU-2024:0148-1)	Nessus	SuSE Local Security Checks	medium
189229	SUSE SLES12 Security Update : rear27a (SUSE-SU-2024:0135-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-23301

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium