CVE-2016-8637

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.

A local information disclosure issue was found in dracut when generating initramfs images with world-readable permissions when "early cpio" is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials (CVE-2016-8637).

These are all security issues fixed in the dracut-044-17.1 package on the GA media of openSUSE Tumbleweed.

This update for dracut fixes the following issues:

Security issues fixed:

• CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd would be read-only available for all users, allowing local users to retrieve secrets stored in the initial ramdisk. (bsc#1008340)

Non security issues fixed:

• Allow booting from degraded MD arrays with systemd. (bsc#1017695)
• Start multipath services before local-fs-pre.target. (bsc#1005410, bsc#1006118, bsc#1007925, bsc#986734, bsc#986838)

This update for dracut fixes the following issues:

Security issues fixed:

• CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd would be read-only available for all users, allowing local users to retrieve secrets stored in the initial ramdisk. (bsc#1008340)

Non security issues fixed:

• Remove zlib module as requirement. (bsc#1020063)
• Unlimit TaskMax for xfs_repair in emergency shell. (bsc#1019938)
• Resolve symbolic links for -i and -k parameters. (bsc#902375)
• Enhance purge-kernels script to handle kgraft patches. (bsc#1017141)
• Allow booting from degraded MD arrays with systemd. (bsc#1017695)
• Allow booting on s390x with fips=1 on the kernel command line. (bnc#1021687)
• Start multipath services before local-fs-pre.target. (bsc#1005410, bsc#1006118, bsc#1007925)
• Fix /sbin/installkernel to handle kernel packages built with 'make bin-rpmpkg'. (bsc#1008648)

This update for dracut fixes the following issues:

Security issues fixed:

• CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd would be read-only available for all users, allowing local users to retrieve secrets stored in the initial ramdisk. (bsc#1008340)

Non-security issues fixed:

• Skip iBFT discovery for qla4xxx flashnode session. (bsc#935320)
• Set MTU and LLADDR for DHCP if specified. (bsc#959803)
• Allow booting from degraded MD arrays with systemd. (bsc#1017695)
• Start multipath services before local-fs-pre.target. (bsc#1005410, bsc#1006118, bsc#1007925, bsc#986734, bsc#986838)
• Fixed /sbin/installkernel to handle kernel packages built with 'make bin-rpmpkg'. (bsc#1008648)
• Fixed typo in installkernel script. (bsc#1032576)
• Fixed subnet calculation in mkinitrd. (bsc#1035743)

It was discovered that dracut created initramfs images with overly permissive permissions under certain circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-8637)

It was discovered that dracut did not properly sanitize DHCP options before writing them to shell scripts under certain circumstances. A remote attacker controlling a DHCP server on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-6893)

It was discovered that dracut did not properly quote error messages written to shell scripts under certain circumstances. A remote attacker controlling a DHCP server on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-15816)

It was discovered that dracut did not properly sanitize network configuration data before writing it to a temporary shell script under certain circumstances. A remote attacker controlling DHCP on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 22.04 LTS. (CVE-2026-16445)