dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2014-007:01 advisory.

    dracut is a new, event-driven initramfs infrastructure based around udev.
    Security issues fixed with this release:
     CVE-2012-4453     dracut.sh in dracut creates initramfs images with world-readable permissions, which might allow local     users to obtain sensitive information.
    Fixed bugs:
     Added the previously missing mkinitrd(8) man page.
     Previously, specification of the original logical volume name (rd_LVM_LV) was required when booting an     LVM snapshot. The dracut utility now calls the lvchange command with the --yes option, which makes     booting LVM snapshots more intuitive.
     Previously, initramfs could contain stale symbolic links because the dracut utility copied them without     following every redirection. This has been fixed.
     Previously, when setting up crypto devices, the dracut utility failed to take into account all parameters     of the /etc/crypttab file and options and file names in /etc/crypttab had no effect in initramfs. This has     been fixed.
     dracuts now starts the iSCSI service regardless of the network configuration parameters on the kernel     command line, so that it is possible to boot with iSCSI even on systems that do not need a network     configuration.
     Previously, if the user set GREP_OPTIONS while calling yum or running dracut, grep did not work correctly     with dracut. dracut now unsets GREP_OPTIONS and user settings prior to running.
     Previously, the multipath configuration file was always included in the initramfs, even if the root     device was not a multipath device. As a result, the administrator had to update initramfs before rebooting     when changing the multipath configuration. This has been fixed and dracut only inculdes the multipath     configuration if the root device is a multipath device. The configuration can also be split:
     /etc/multipath-root.conf      /etc/multipath-root/*      /etc/xdrdevices-root.conf     These files will be used in initramfs as follows:
     /etc/multipath.conf      /etc/multipath/*      /etc/xdrdevices.conf      When using the Red Hat Enterprise Virtualization Hypervisor packaging of the kernel on a live image,     booting an installation in FIPS mode now checks the correct kernel image and if the checksum is correct,     the system continues to boot in FIPS mode.
     Dracut now includes the xhci-hcd driver in initramfs, and the system is able to boot from USB 3.0 disks.
     Previously, if the biosdevname=1 parameter had not been specified on the kernel command line, the     dracut utility disabled biosdevname network interface renaming on all machines. Consequently, on Dell     machines, interfaces used in initramfs did not have automatic biosdevname names, even though biosdevname     interface renaming was active later in the boot process. With this update, dracut only disables     biosdevname if the parameter is set to 0. For non-Dell machines, biosdevname now renames interfaces only     if biosdevname=1 is specified on the kernel command line, and Dell machines have biosdevname named     interfaces in initramfs.
     Previously, it took too long to activate Fibre Channel over Ethernet (FcoE) on a 10GBaseT Twin Pond     adapter and the fipvlan utility called by dracut would time out. To fix this, fipvlan is now called with a     30 seconds waiting time.
     Previously, when running the ldd tool, the dracut utility output could end up in the standard error     output. This has been fixed and cat error messages are now hidden in this case.
     Previously, systems with encrypted disks cound not boot succesfully in FIPS mode. This has been fixed:
    the dracut utility now copies all the needed files in the initramfs and the system boots successfully.
     Previously, when booting live ISO images in FIPS mode, dracut searched for the checksum file of the     kernel image in the wrong place and boot failed. This has been fixed.
    Enhancements      Added the /etc/system-fips file marker when the dracut-fips rpm package is installed to provide a stable     file location for FIPS,a s required by the National Institute of Standards and Technology (NIST).
     Added support for bonding of network interfaces in initramfs     Format: bond=<bondname>[:<bondslaves>:[:<options>]]     Refer to the modinfo bonding command for more help.
     It is now possible to turn off the multipath device mapper if the multipath dracut module is included in     the initramfs with the newly added rd_NO_MULTIPATH kernel command line option.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that dracut created initramfs images as world readable. A local user could possibly use this flaw to obtain sensitive information from these files, such as iSCSI authentication passwords, encrypted root file system crypttab passwords, or other information. (CVE-2012-4453)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1674 advisory.

    [004-336.0.1]
    - do not strip modules with signatures. [orabug 17458249] (Jerry Snitselaar)
    - scsi_wait module removed in 3.8. Mute errors. [orabug 16977193] (Maxim Uvarov)       find firmware in /lib/modules/firmware/2.6.32-400.1.1.el5uek first       and /lib/modules/firmware second (<maxim.uvarov@oracle.com)       Resolves: Orabug: 13351090
    - Fix btrfs discovery [orabug 13388545]

    [004-336]
    - install /etc/system-fips in the initramfs     Resolves: rhbz#1012626

    [004-335]
    - fixed interface renaming     Resolves: rhbz#1019104

    [004-334]
    - fcoe: add --link-retry=100 to fipvlan call     Resolves: rhbz#1012316
    - ldd: redirect error to /dev/null
    - do not turn off biosdevname, if not given on kernel cmdline     Resolves: rhbz#1011508
    - network: fixed ibft parsing     Resolves: rhbz#1011508

    [004-330]
    - changed /etc/redhat-fips to /etc/system-fips     Resolves: rhbz#1012626

    [004-329]
    - add /etc/redhat-fips     Resolves: rhbz#1012626

    [004-328]
    - fixed crypt: add support for keyfiles in the initramfs     Resolves: rhbz#886194

    [004-327]
    - fixed crypt: add support for keyfiles in the initramfs     Resolves: rhbz#886194
    - fixed booting with iSCSI and without network config     Resolves: rhbz#910605

    [004-322]
    - fixed crypt: add support for keyfiles in the initramfs     Resolves: rhbz#886194
    - fixed FIPS module checking     Resolves: rhbz#947729

    [004-316]
    - create the initramfs non-world readable
    - unset LD_LIBRARY_PATH and GREP_OPTIONS     Resolves: rhbz#912299
    - add mkinitrd man page     Resolves: rhbz#610462
    - add bonding     Resolves: rhbz#851666
    - lvm: add '--yes' to lvchange     Resolves: rhbz#720684
    - crypt: add support for keyfiles in the initramfs     Resolves: rhbz#886194
    - start iscsi regardless of network, if requested     Resolves: rhbz#813687
    - install multipath module only, when root is multipath in generic mode     Resolves: rhbz#916144
    - fips: handle checksum checks for RHEV kernels     Resolves: rhbz#947729
    - add xhci-hcd driver     Resolves: rhbz#960729

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated dracut packages that fix one security issue, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The dracut packages include an event-driven initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.

It was discovered that dracut created initramfs images as world readable. A local user could possibly use this flaw to obtain sensitive information from these files, such as iSCSI authentication passwords, encrypted root file system crypttab passwords, or other information. (CVE-2012-4453)

This issue was discovered by Peter Jones of the Red Hat Installer Team.

These updated dracut packages include numerous bug fixes and two enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All dracut users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

- fixed ifup exit code

    - fixed default 'rd.auto' parameter setting

    - only 'warn' not 'error', if we don't strip the       initramfs

    - do not overwrite ifcfg from anaconda

    - ssh-client module fixes

    - strip binaries in the initramfs by default now

    - fixes for systemd and crypto

    - new dracut kernel command line options 'rd.auto'

    - new dracut kernel command line options       'rd.noverifyssl'

    - new dracut option '--kernel-cmdline' and       'kernel_cmdline' option for default parameters

    - fix for kexec in shutdown, if not included in       initramfs

  - no more iscsi_wait_scan

    - curl: give info what URL failed, support https

    - use findmnt

    - systemd: wait for crypto target

    - only install crypttab in host-only mode

    - add udev groups

    - fixed busybox install

    - fixed rd.luks.allow-discards manpage and handling

    - force install dm_mod

    - do not create the initramfs world reabable

    - add nameserver even for dhcp

    - fallback to reboot if shutdown was called without a       parameter

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

dracut-018-60.git20120927

  - run dracut-shutdown.service before shutdown.target     Resolves: rhbz#840120

  - do not create the initramfs world readable Resolves:
    rhbz#859448

  - mdraid: do the dracut shutdown, if a md raid is found

    - mdraid: handle nested md raids

    - mdraid: wait until devices are clean on shutdown       Resolves: rhbz#732297 rhbz#840562

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

dracut-018-105.git20120927

  - enable the use of the nbd port with e.g. '-N ltsp'

    - actually make reset_overlay working for squash       overlays

    - fixed FIPS

    - if any mdraid found, make dracut run on shutdown

    - make the initramfs non-world readable

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
289060	MiracleLinux 4 : dracut-004-336.AXS4.2 (AXSA:2014-007:01)	Nessus	Miracle Linux Local Security Checks	medium
71397	Amazon Linux AMI : dracut (ALAS-2013-257)	Nessus	Amazon Linux Local Security Checks	low
71297	Scientific Linux Security Update : dracut on SL6.x (noarch) (20131121)	Nessus	Scientific Linux Local Security Checks	low
71111	Oracle Linux 6 : dracut (ELSA-2013-1674)	Nessus	Oracle Linux Local Security Checks	medium
71016	RHEL 6 : dracut (RHSA-2013:1674)	Nessus	Red Hat Local Security Checks	low
62698	Fedora 18 : dracut-024-5.git20121019.fc18 (2012-16448)	Nessus	Fedora Local Security Checks	low
62526	Fedora 16 : dracut-018-60.git20120927.fc16 (2012-14959)	Nessus	Fedora Local Security Checks	low
62525	Fedora 17 : dracut-018-105.git20120927.fc17 (2012-14953)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2012-4453

medium

Tenable Plugins

medium

low

low

medium

low

low

low

low