Security update for dracut SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2696-1 Final 1 1 2017-10-10T13:55:33Z current 2017-10-10T13:55:33Z 2017-10-10T13:55:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dracut This update for dracut fixes the following issues: Security issues fixed: - CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd would be read-only available for all users, allowing local users to retrieve secrets stored in the initial ramdisk. (bsc#1008340) Non-security issues fixed: - Skip iBFT discovery for qla4xxx flashnode session. (bsc#935320) - Set MTU and LLADDR for DHCP if specified. (bsc#959803) - Allow booting from degraded MD arrays with systemd. (bsc#1017695) - Start multipath services before local-fs-pre.target. (bsc#1005410, bsc#1006118, bsc#1007925, bsc#986734, bsc#986838) - Fixed /sbin/installkernel to handle kernel packages built with 'make bin-rpmpkg'. (bsc#1008648) - Fixed typo in installkernel script. (bsc#1032576) - Fixed subnet calculation in mkinitrd. (bsc#1035743) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-SERVER-12-2017-1669 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172696-1/ Link for SUSE-SU-2017:2696-1 https://lists.suse.com/pipermail/sle-security-updates/2017-October/003286.html E-Mail link for SUSE-SU-2017:2696-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1005410 SUSE Bug 1005410 https://bugzilla.suse.com/1006118 SUSE Bug 1006118 https://bugzilla.suse.com/1007925 SUSE Bug 1007925 https://bugzilla.suse.com/1008340 SUSE Bug 1008340 https://bugzilla.suse.com/1008648 SUSE Bug 1008648 https://bugzilla.suse.com/1017695 SUSE Bug 1017695 https://bugzilla.suse.com/1032576 SUSE Bug 1032576 https://bugzilla.suse.com/1035743 SUSE Bug 1035743 https://bugzilla.suse.com/935320 SUSE Bug 935320 https://bugzilla.suse.com/959803 SUSE Bug 959803 https://bugzilla.suse.com/986734 SUSE Bug 986734 https://bugzilla.suse.com/986838 SUSE Bug 986838 https://www.suse.com/security/cve/CVE-2016-8637/ SUSE CVE CVE-2016-8637 page SUSE Linux Enterprise Server 12-LTSS dracut-037-51.31.1 dracut-fips-037-51.31.1 dracut-037-51.31.1 as a component of SUSE Linux Enterprise Server 12-LTSS dracut-fips-037-51.31.1 as a component of SUSE Linux Enterprise Server 12-LTSS A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials. CVE-2016-8637 SUSE Linux Enterprise Server 12-LTSS:dracut-037-51.31.1 SUSE Linux Enterprise Server 12-LTSS:dracut-fips-037-51.31.1 low 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172696-1/ https://www.suse.com/security/cve/CVE-2016-8637.html CVE-2016-8637 https://bugzilla.suse.com/1008340 SUSE Bug 1008340