{"id":"CVE-2024-23301","aliases":["ALSA-2024:1147","ALSA-2024:1719","AZL-43810","AZL-44403","DEBIAN-CVE-2024-23301","DLA-3733-1","DLA-4400-1","EUVD-2024-20820","GHSA-5g36-x562-44f9","MGASA-2024-0131","OESA-2024-1077","RHSA-2024:1147","RHSA-2024:1719","RLSA-2024:1719","SUSE-SU-2024:0135-1","SUSE-SU-2024:0148-1","SUSE-SU-2024:0190-1","SUSE-SU-2024:0239-1","SUSE-SU-2024:0247-1","SUSE-SU-2024:0253-1","SUSE-SU-2024:0291-1","SUSE-SU-2024:0292-1","SUSE-SU-2024:0657-1","UBUNTU-CVE-2024-23301","USN-8988-1","openSUSE-SU-2024:13612-1"],"status":"published","title":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y...","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00291,"percentile":0.21927,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2024-01-12T00:00:00Z","modified":"2026-11-04T03:43:13Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"rear","fixed_in":["2.6-21.el9_3.alma"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rear","fixed_in":["2.6-11.el8_9.alma.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rear","fixed_in":["2.7+dfsg-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rear","fixed_in":["2.7+dfsg-1.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rear","fixed_in":["2.7+dfsg-1.2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"rear","fixed_in":["2.4+dfsg-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"rear","fixed_in":["2.6+dfsg-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"rear","fixed_in":["2.6-2.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rear","fixed_in":["2.4-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"rear","fixed_in":["2.4-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"rear","fixed_in":["2.4-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"rear","fixed_in":["2.4-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"rear","fixed_in":["2.4-5.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"rear","fixed_in":["2.4-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rear","fixed_in":["0:2.6-21.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rear","fixed_in":["0:2.6-11.el8_9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"rear","fixed_in":["0:2.6-11.el8_9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"rear27a","fixed_in":["2.7-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"rear23a","fixed_in":["2.3.a-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"rear118a","fixed_in":["1.18.a-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rear23a","fixed_in":["2.3.a-150000.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rear23a","fixed_in":["2.3.a-150000.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rear23a","fixed_in":["2.3.a-150300.21.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rear23a","fixed_in":["2.3.a-150300.21.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"rear23a","fixed_in":["2.3.a-150300.21.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"rear23a","fixed_in":["2.3.a-150300.21.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rear27a","fixed_in":["2.7-150200.5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rear27a","fixed_in":["2.7-150200.5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rear27a","fixed_in":["2.7-150200.5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"rear116","fixed_in":["1.16-15.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"rear1172a","fixed_in":["1.17.2.a-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"rear27a","fixed_in":["2.7-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"rear27a","fixed_in":["2.7-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rear","fixed_in":["2.3+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rear","fixed_in":["2.5+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rear","fixed_in":["2.6+dfsg-1+deb11u1build0.22.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rear","fixed_in":["2.7-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-21.el9_3.alma"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-11.el8_9.alma.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7+dfsg-1+deb12u1"}]}],"versions":["2.7+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7+dfsg-1.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7+dfsg-1.2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4+dfsg-1+deb10u1"}]}],"versions":["2.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:11","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6+dfsg-1+deb11u1"}]}],"versions":["2.6+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-2.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-5.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6-21.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6-11.el8_9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6-11.el8_9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"rear27a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"rear23a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.a-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"rear118a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.a-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rear23a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.a-150000.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rear23a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.a-150000.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rear23a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.a-150300.21.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rear23a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.a-150300.21.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"rear23a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.a-150300.21.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"rear23a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.a-150300.21.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rear27a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-150200.5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rear27a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-150200.5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rear27a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-150200.5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"rear116","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-15.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"rear1172a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.2.a-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"rear27a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"rear27a","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3+dfsg-1ubuntu0.1~esm1"}]}],"versions":["2.2+dfsg-2","2.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5+dfsg-1ubuntu0.1~esm1"}]}],"versions":["2.5+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6+dfsg-1+deb11u1build0.22.04.1"}]}],"versions":["2.6+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3+dfsg-1ubuntu0.1~esm1"}]}],"versions":["2.2+dfsg-2","2.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5+dfsg-1ubuntu0.1~esm1"}]}],"versions":["2.5+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6+dfsg-1+deb11u1build0.22.04.1"}]}],"versions":["2.6+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-2.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"relax-and-recover","product":"relax-and-recover"},{"vendor":"suse","product":"linux_enterprise"}],"references":[{"url":"https://github.com/rear/rear/issues/3122","tags":["x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","report","article"]},{"url":"https://github.com/rear/rear/pull/3123","tags":["x_transferred","Patch","Vendor Advisory","fix","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/02/msg00003.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JIN57LUPBI2GDJOK3PYXNHJTZT3AQTZ/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHKMPXJNXEJJE6EVYE5HM7EKEJFQMBN7/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7JIN57LUPBI2GDJOK3PYXNHJTZT3AQTZ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UHKMPXJNXEJJE6EVYE5HM7EKEJFQMBN7/","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/12/msg00011.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23301","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JIN57LUPBI2GDJOK3PYXNHJTZT3AQTZ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHKMPXJNXEJJE6EVYE5HM7EKEJFQMBN7"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7JIN57LUPBI2GDJOK3PYXNHJTZT3AQTZ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UHKMPXJNXEJJE6EVYE5HM7EKEJFQMBN7"},{"url":"https://github.com/advisories/GHSA-5g36-x562-44f9"},{"url":"https://access.redhat.com/errata/RHSA-2024:1147","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23301","tags":["report"]},{"url":"https://bugzilla.redhat.com/2258396","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-1147.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1719","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-1719.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23301.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-23301","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0131.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33085","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1077","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258396","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1147.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23301","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1719.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:1719","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240135-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218728","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23301","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240148-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240190-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240239-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240247-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240253-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240291-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240292-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240657-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23301","tags":["report"]},{"url":"https://github.com/rear/rear/commit/89b61793d80bc2cb2abe47a7d0549466fb087d16","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8988-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-23301","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.","status":"published","published":"2024-01-12T00:00:00Z","modified":"2025-12-10T17:05:56.699Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:34:05.077718Z"}],"euvd":[{"id":"EUVD-2024-20820","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.","status":"published","published":"2024-01-12T00:00:00Z","modified":"2025-12-10T17:05:56Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:07.060478Z"}],"ghsa":[{"id":"GHSA-5g36-x562-44f9","title":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y...","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.","status":"published","published":"2024-01-13T00:30:25Z","modified":"2025-12-10T18:30:21Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:05:07.56832Z"}],"nvd":[{"id":"CVE-2024-23301","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.","status":"published","published":"2024-01-12T23:15:10.03Z","modified":"2026-06-17T07:12:33.017Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:09:30.070039Z"}],"osv":[{"id":"AZL-43810","title":"CVE-2024-23301 affecting package rear 2.4-7","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.","status":"published","published":"2024-01-12T23:15:10Z","modified":"2026-04-21T04:31:10.065382Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44403","title":"CVE-2024-23301 affecting package rear 2.4-7","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.","status":"published","published":"2024-01-12T23:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2024-23301","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.","status":"published","published":"2024-01-12T00:00:00Z","modified":"2026-10-28T02:31:01.984685723Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"DEBIAN-CVE-2024-23301","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.","status":"published","published":"2024-01-12T23:15:10.03Z","modified":"2026-11-02T12:00:48.567635716Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-1077","title":"rear security update","description":"Relax-and-Recover is a setup-and-forget Linux bare metal disaster recovery solution. It is easy to set up and requires no maintenance so there is no excuse for not using it.\r\n\r\nSecurity Fix(es):\r\n\r\nRelax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.(CVE-2024-23301)","status":"published","published":"2024-01-19T11:06:31Z","modified":"2026-08-18T01:18:12.69939512Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2024:1147","title":"Red Hat Security Advisory: rear security update","status":"published","published":"2024-09-16T17:52:36Z","modified":"2026-03-18T11:32:21.286733Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1719","title":"Red Hat Security Advisory: rear security update","status":"published","published":"2024-09-16T17:52:46Z","modified":"2026-03-18T11:34:54.779724Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2024-23301","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.","status":"published","published":"2024-01-12T23:15:00Z","modified":"2026-11-04T03:30:07.457742908Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-04T03:56:45.249606Z"},{"id":"ALSA-2024:1147","title":"Moderate: rear security update","description":"Relax-and-Recover is a recovery and system migration utility. The utility produces a bootable image and restores from backup using this image. It allows to restore to different hardware and can therefore be also used as a migration utility.\n\nSecurity Fix(es):\n\n* rear: creates a world-readable initrd (CVE-2024-23301)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-03-05T00:00:00Z","modified":"2026-10-29T11:31:05.456157368Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:1719","title":"Moderate: rear security update","description":"Relax-and-Recover is a recovery and system migration utility. The utility produces a bootable image and restores from backup using this image. It allows to restore to different hardware and can therefore be also used as a migration utility.\n\nSecurity Fix(es):\n\n* rear: creates a world-readable initrd (CVE-2024-23301)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-04-09T00:00:00Z","modified":"2026-10-29T11:02:27.689268748Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"DLA-3733-1","title":"rear - security update","status":"published","published":"2024-02-03T00:00:00Z","modified":"2026-03-09T01:20:00.662876Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-4400-1","title":"rear - security update","status":"published","published":"2025-12-10T00:00:00Z","modified":"2025-12-10T17:14:53.285597Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2024-0131","title":"Updated rear packages fix security vulnerability","description":"Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd\nwhen using GRUB_RESCUE=y. This allows local attackers to gain access to\nsystem secrets otherwise only readable by root. (CVE-2024-23301)\n","status":"published","published":"2024-04-13T16:56:38Z","modified":"2026-04-16T04:41:45.466595675Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13612-1","title":"rear-2.7-2.1 on GA media","description":"These are all security issues fixed in the rear-2.7-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:02:14.882113Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2024:1719","title":"Moderate: rear security update","description":"Relax-and-Recover is a recovery and system migration utility. The utility produces a bootable image and restores from backup using this image. It allows to restore to different hardware and can therefore be also used as a migration utility.\n\nSecurity Fix(es):\n\n* rear: creates a world-readable initrd (CVE-2024-23301)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-05-06T13:04:21.002456Z","modified":"2026-02-04T20:45:07.936213Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2024:0135-1","title":"Security update for rear27a","description":"This update for rear27a fixes the following issues:\n\n- CVE-2024-23301: Fixed ReaR creates world-readable initrd with GRUB_RESCUE=Y. (bsc#1218728)\n","status":"published","published":"2024-01-18T08:33:53Z","modified":"2026-02-04T04:20:00.724405Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0148-1","title":"Security update for rear23a","description":"This update for rear23a fixes the following issues:\n\n- CVE-2024-23301: Fixed ReaR creates world-readable initrd with GRUB_RESCUE=Y. (bsc#1218728)\n","status":"published","published":"2024-01-18T13:13:34Z","modified":"2026-02-04T02:59:45.52001Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0190-1","title":"Security update for rear118a","description":"This update for rear118a fixes the following issues:\n\n- CVE-2024-23301: Corrected world-readable permissions for initrd,\n  which could be an issue if it contains sensitive information\n  (bsc#1218728).\n","status":"published","published":"2024-01-23T14:28:51Z","modified":"2026-02-04T04:15:22.589924Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0239-1","title":"Security update for rear23a","description":"This update for rear23a fixes the following issues:\n\n- CVE-2024-23301: Corrected world-readable permissions for initrd,\n  which could be an issue if it contains sensitive information\n  (bsc#1218728).\n","status":"published","published":"2024-01-26T09:57:07Z","modified":"2026-02-04T03:10:32.299616Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0247-1","title":"Security update for rear23a","description":"This update for rear23a fixes the following issues:\n\n- CVE-2024-23301: Fixed ReaR creates world-readable initrd with GRUB_RESCUE=Y. (bsc#1218728)\n","status":"published","published":"2024-01-26T13:01:46Z","modified":"2026-02-04T02:35:28.999705Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0253-1","title":"Security update for rear27a","description":"This update for rear27a fixes the following issues:\n\n- CVE-2024-23301: Fixed ReaR creates world-readable initrd with GRUB_RESCUE=Y. (bsc#1218728)\n","status":"published","published":"2024-01-26T14:31:20Z","modified":"2026-02-04T02:23:54.502936Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0291-1","title":"Security update for rear116","description":"This update for rear116 fixes the following issues:\n\n- CVE-2024-23301: Corrected world-readable permissions for initrd,\n  which could be an issue if it contains sensitive information\n  (bsc#1218728).\n","status":"published","published":"2024-01-31T14:08:20Z","modified":"2026-02-04T03:31:39.561344Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0292-1","title":"Security update for rear1172a","description":"This update for rear1172a fixes the following issues:\n\n- CVE-2024-23301: Corrected world-readable permissions for initrd,\n  which could be an issue if it contains sensitive information\n  (bsc#1218728).\n","status":"published","published":"2024-01-31T14:08:25Z","modified":"2026-02-04T02:25:31.021196Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0657-1","title":"Security update for rear27a","description":"This update for rear27a fixes the following issues:\n\n- CVE-2024-23301: Fixed world-readable initrd with GRUB_RESCUE=Y (bsc#1218728).\n\nBug fixes:\n\n- Fix mkinitrd dependency issue by installing dracut-mkinitrd-deprecated (see bsc#1202352).\n","status":"published","published":"2024-02-28T14:05:12Z","modified":"2026-02-04T03:21:18.564823Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-8988-1","title":"rear vulnerability","description":"It was discovered that Relax-and-Recover created a world-readable initrd\nwhen GRUB_RESCUE was enabled. A local attacker could possibly use this\nissue to obtain sensitive information.","status":"published","published":"2026-11-03T17:37:16Z","modified":"2026-11-04T03:43:13.951164681Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}