Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2024:1719 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1719 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-1719 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1719 advisory.

  - rear: creates a world-readable initrd (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1147 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-1147 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1147 advisory.

  - rear: creates a world-readable initrd (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0657-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a2f6e5ddb8 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-49ddbf447d advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of rear installed on the remote host is prior to 2.00-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2451 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3733 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0291-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0292-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0253-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0247-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0239-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0190-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0148-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:0135-1 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195001	Rocky Linux 8 : rear (RLSA-2024:1719)	Nessus	Rocky Linux Local Security Checks	medium
193166	AlmaLinux 8 : rear (ALSA-2024:1719)	Nessus	Alma Linux Local Security Checks	medium
193162	Oracle Linux 8 : rear (ELSA-2024-1719)	Nessus	Oracle Linux Local Security Checks	medium
193112	RHEL 8 : rear (RHSA-2024:1719)	Nessus	Red Hat Local Security Checks	medium
191690	AlmaLinux 9 : rear (ALSA-2024:1147)	Nessus	Alma Linux Local Security Checks	medium
191644	Oracle Linux 9 : rear (ELSA-2024-1147)	Nessus	Oracle Linux Local Security Checks	medium
191574	RHEL 9 : rear (RHSA-2024:1147)	Nessus	Red Hat Local Security Checks	medium
191133	SUSE SLES15 / openSUSE 15 Security Update : rear27a (SUSE-SU-2024:0657-1)	Nessus	SuSE Local Security Checks	medium
190824	Fedora 39 : rear (2024-a2f6e5ddb8)	Nessus	Fedora Local Security Checks	medium
190823	Fedora 38 : rear (2024-49ddbf447d)	Nessus	Fedora Local Security Checks	medium
190017	Amazon Linux 2 : rear (ALAS-2024-2451)	Nessus	Amazon Linux Local Security Checks	medium
189974	Debian dla-3733 : rear - security update	Nessus	Debian Local Security Checks	medium
189878	SUSE SLES12 Security Update : rear116 (SUSE-SU-2024:0291-1)	Nessus	SuSE Local Security Checks	medium
189877	SUSE SLES12 Security Update : rear1172a (SUSE-SU-2024:0292-1)	Nessus	SuSE Local Security Checks	medium
189720	SUSE SLES15 Security Update : rear27a (SUSE-SU-2024:0253-1)	Nessus	SuSE Local Security Checks	medium
189713	SUSE SLES15 / openSUSE 15 Security Update : rear23a (SUSE-SU-2024:0247-1)	Nessus	SuSE Local Security Checks	medium
189711	SUSE SLES15 Security Update : rear23a (SUSE-SU-2024:0239-1)	Nessus	SuSE Local Security Checks	medium
189399	SUSE SLES12 Security Update : rear118a (SUSE-SU-2024:0190-1)	Nessus	SuSE Local Security Checks	medium
189230	SUSE SLES12 Security Update : rear23a (SUSE-SU-2024:0148-1)	Nessus	SuSE Local Security Checks	medium
189229	SUSE SLES12 Security Update : rear27a (SUSE-SU-2024:0135-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-23301

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium