{"id":"CVE-2016-8637","aliases":["DEBIAN-CVE-2016-8637","EUVD-2016-9480","GHSA-wf9g-696p-j466","MGASA-2016-0387","SUSE-SU-2017:0641-1","SUSE-SU-2017:0951-1","SUSE-SU-2017:2696-1","UBUNTU-CVE-2016-8637","USN-8828-1","openSUSE-SU-2024:10225-1"],"status":"published","title":"A local information disclosure issue was found in dracut before 045 when generating initramfs...","description":"A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.","severity":{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.00309,"percentile":0.23863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-732"],"published":"2016-11-17T23:40:52Z","modified":"2026-10-20T10:47:31Z","fixes":[{"ecosystem":"Debian:12","package":"dracut","fixed_in":["044+189-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dracut","fixed_in":["044+189-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dracut","fixed_in":["044+189-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"dracut","fixed_in":["038-21.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"dracut","fixed_in":["037-91.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"dracut","fixed_in":["037-91.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dracut","fixed_in":["037-91.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"dracut","fixed_in":["044-108.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dracut","fixed_in":["044-108.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dracut","fixed_in":["044-108.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dracut","fixed_in":["044-108.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"dracut","fixed_in":["037-51.31.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dracut","fixed_in":["044+3-3ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044+189-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044+189-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044+189-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"038-21.1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"037-91.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"037-91.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"037-91.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044-108.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044-108.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044-108.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044-108.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"037-51.31.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044+3-3ubuntu0.1~esm1"}]}],"versions":["043-2","043-4","044+3-1","044+3-2","044+3-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044+3-3ubuntu0.1~esm1"}]}],"versions":["043-2","043-4","044+3-1","044+3-2","044+3-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"047-2ubuntu0.1~esm1"}]}],"versions":["045+132-1","047-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"048+80-2ubuntu0.1~esm1"}]}],"versions":["048+80-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"051-1ubuntu0.1~esm1"}]}],"versions":["051-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"060+5-1ubuntu3.4"}]}],"versions":["059-4ubuntu2","060+5-1ubuntu1","060+5-1ubuntu2","060+5-1ubuntu3","060+5-1ubuntu3.1","060+5-1ubuntu3.2","060+5-1ubuntu3.3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"110-11ubuntu0.1"}]}],"versions":["108-3ubuntu3","108-8ubuntu1","109-5ubuntu1","109-7ubuntu1","109-9ubuntu1","109-11ubuntu1","110-1ubuntu2","110-3ubuntu1","110-5","110-7","110-10","110-11"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044-17.1"}]}],"bundled":2}],"products":[{"vendor":"dracut_project","product":"dracut"},{"vendor":"the dracut project","product":"dracut"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8637","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/dracutdevs/dracut/commit/0db98910a11c12a454eac4c8e86dc7a7bbc764a4","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/94128","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://seclists.org/oss-sec/2016/q4/352","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8637"},{"url":"https://github.com/advisories/GHSA-wf9g-696p-j466"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-8637","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19731","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2VA7LTNATN2EKBHSSHB35W5AXITXVLG6/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170641-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1005410","tags":["report"]},{"url":"https://bugzilla.suse.com/1006118","tags":["report"]},{"url":"https://bugzilla.suse.com/1007925","tags":["report"]},{"url":"https://bugzilla.suse.com/1008340","tags":["report"]},{"url":"https://bugzilla.suse.com/1017695","tags":["report"]},{"url":"https://bugzilla.suse.com/986734","tags":["report"]},{"url":"https://bugzilla.suse.com/986838","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8637","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170951-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008648","tags":["report"]},{"url":"https://bugzilla.suse.com/1017141","tags":["report"]},{"url":"https://bugzilla.suse.com/1019938","tags":["report"]},{"url":"https://bugzilla.suse.com/1020063","tags":["report"]},{"url":"https://bugzilla.suse.com/1021687","tags":["report"]},{"url":"https://bugzilla.suse.com/902375","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172696-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1032576","tags":["report"]},{"url":"https://bugzilla.suse.com/1035743","tags":["report"]},{"url":"https://bugzilla.suse.com/935320","tags":["report"]},{"url":"https://bugzilla.suse.com/959803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8637","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8637","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8828-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6893","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-15816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-16445","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4453","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-8637","description":"A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.","status":"published","published":"2018-08-01T13:00:00Z","modified":"2024-08-06T02:27:41.222Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:33:32.724067Z"}],"euvd":[{"id":"EUVD-2016-9480","description":"A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.","status":"published","published":"2018-08-01T13:00:00Z","modified":"2024-08-06T02:27:41Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:22:29.639634Z"}],"ghsa":[{"id":"GHSA-wf9g-696p-j466","title":"A local information disclosure issue was found in dracut before 045 when generating initramfs...","description":"A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.","status":"published","published":"2022-05-13T01:38:38Z","modified":"2023-02-13T00:31:06Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-200","CWE-732"],"updated_at":"2026-11-02T14:54:05.462623Z"}],"nvd":[{"id":"CVE-2016-8637","description":"A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.","status":"published","published":"2018-08-01T13:29:00.263Z","modified":"2026-06-17T00:54:39.44Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-732","CWE-200"],"updated_at":"2026-11-02T14:03:39.621168Z"}],"osv":[{"id":"CVE-2016-8637","description":"A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.","status":"published","published":"2018-08-01T13:29:00.263Z","modified":"2026-10-20T10:47:31.844310538Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-8637","description":"A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.","status":"published","published":"2018-08-01T13:29:00.263Z","modified":"2026-09-22T07:02:36.178532047Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-8637","description":"A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.","status":"published","published":"2018-08-01T13:29:00Z","modified":"2026-09-28T22:45:12.942381246Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"MGASA-2016-0387","title":"Updated dracut packages fix security vulnerability","description":"A local information disclosure issue was found in dracut when generating\ninitramfs images with world-readable permissions when \"early cpio\" is\nused, such as when including microcode updates. Local attacker can use\nthis to obtain sensitive information from these files, such as encryption\nkeys or credentials (CVE-2016-8637).\n","status":"published","published":"2016-11-17T23:40:52Z","modified":"2026-04-16T06:22:48.229123441Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10225-1","title":"dracut-044-17.1 on GA media","description":"These are all security issues fixed in the dracut-044-17.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:29:30.743889Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2017:0641-1","title":"Security update for dracut","description":"\nThis update for dracut fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd\n  would be read-only available for all users, allowing local users to retrieve secrets stored in\n  the initial ramdisk. (bsc#1008340)\n\nNon security issues fixed:\n\n- Allow booting from degraded MD arrays with systemd. (bsc#1017695)\n- Start multipath services before local-fs-pre.target. (bsc#1005410, bsc#1006118, bsc#1007925,\n  bsc#986734, bsc#986838)\n","status":"published","published":"2017-03-09T09:31:06Z","modified":"2026-02-04T02:34:52.087268Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0951-1","title":"Security update for dracut","description":"\nThis update for dracut fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd\n  would be read-only available for all users, allowing local users to retrieve secrets stored in\n  the initial ramdisk. (bsc#1008340)\n\nNon security issues fixed:\n\n- Remove zlib module as requirement. (bsc#1020063)\n- Unlimit TaskMax for xfs_repair in emergency shell. (bsc#1019938)\n- Resolve symbolic links for -i and -k parameters. (bsc#902375)\n- Enhance purge-kernels script to handle kgraft patches. (bsc#1017141)\n- Allow booting from degraded MD arrays with systemd. (bsc#1017695)\n- Allow booting on s390x with fips=1 on the kernel command line. (bnc#1021687)\n- Start multipath services before local-fs-pre.target. (bsc#1005410, bsc#1006118, bsc#1007925)\n- Fix /sbin/installkernel to handle kernel packages built with 'make bin-rpmpkg'. (bsc#1008648)\n","status":"published","published":"2017-04-06T07:31:33Z","modified":"2026-02-04T02:54:20.03079Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:2696-1","title":"Security update for dracut","description":"\nThis update for dracut fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd\n  would be read-only available for all users, allowing local users to retrieve secrets stored in\n  the initial ramdisk. (bsc#1008340)\n\nNon-security issues fixed:\n\n- Skip iBFT discovery for qla4xxx flashnode session. (bsc#935320)\n- Set MTU and LLADDR for DHCP if specified. (bsc#959803)\n- Allow booting from degraded MD arrays with systemd. (bsc#1017695)\n- Start multipath services before local-fs-pre.target. (bsc#1005410, bsc#1006118, bsc#1007925,\n  bsc#986734, bsc#986838)\n- Fixed /sbin/installkernel to handle kernel packages built with 'make bin-rpmpkg'. (bsc#1008648)\n- Fixed typo in installkernel script. (bsc#1032576)\n- Fixed subnet calculation in mkinitrd. (bsc#1035743)\n","status":"published","published":"2017-10-10T13:55:33Z","modified":"2026-02-04T02:26:16.892539Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-8828-1","title":"dracut vulnerabilities","description":"It was discovered that dracut created initramfs images with overly\npermissive permissions under certain circumstances. A local attacker could\npossibly use this issue to obtain sensitive information. This issue only\naffected Ubuntu 16.04 LTS. (CVE-2016-8637)\n\nIt was discovered that dracut did not properly sanitize DHCP options\nbefore writing them to shell scripts under certain circumstances. A remote\nattacker controlling a DHCP server on the local network could possibly use\nthis issue to execute arbitrary code as root during system boot. This issue\nonly affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-6893)\n\nIt was discovered that dracut did not properly quote error messages written\nto shell scripts under certain circumstances. A remote attacker controlling\na DHCP server on the local network could possibly use this issue to execute\narbitrary code as root during system boot. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu\n24.04 LTS. (CVE-2026-15816)\n\nIt was discovered that dracut did not properly sanitize network\nconfiguration data before writing it to a temporary shell script under\ncertain circumstances. A remote attacker controlling DHCP on the local\nnetwork could possibly use this issue to execute arbitrary code as root\nduring system boot. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2026-16445)","status":"published","published":"2026-09-28T13:33:37Z","modified":"2026-09-28T22:57:43.497701288Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}