Log in Start free

Vulnerability · Published Jan 12, 2024 · Assigned by mitre

CVE-2024-23301

Medium 5.5

In plain English

A medium-severity incorrect default permissions in the rear package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 78.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8rear2.6-11.el8_9.alma.1ALSA-2024:1719
AlmaLinux:9rear2.6-21.el9_3.almaALSA-2024:1147
Debian:12rear2.7+dfsg-1+deb12u1DEBIAN-CVE-2024-23301
Debian:13rear2.7+dfsg-1.2DEBIAN-CVE-2024-23301
Debian:14rear2.7+dfsg-1.2DEBIAN-CVE-2024-23301
Rocky Linux:8rear0:2.6-11.el8_9RLSA-2024:1719
Ubuntu:22.04:LTSrear2.6+dfsg-1+deb11u1build0.22.04.1USN-8988-1
Ubuntu:22.04:LTSrear2.6+dfsg-1+deb11u1build0.22.04.1UBUNTU-CVE-2024-23301

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References