CVE-2016-8637

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-08-01 · updated 2026-06-17
Weakness: CWE-732

Description

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.

Affected products

The Dracut Project dracut: before 045 — fixed in 045

How to fix

Upgrade to a fixed version: The Dracut Project dracut 045. Check the vendor advisory for mitigations.

References

http://seclists.org/oss-sec/2016/q4/352
http://www.securityfocus.com/bid/94128
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8637
https://github.com/dracutdevs/dracut/commit/0db98910a11c12a454eac4c8e86dc7a7bbc764a4
http://seclists.org/oss-sec/2016/q4/352
http://www.securityfocus.com/bid/94128
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8637
https://github.com/dracutdevs/dracut/commit/0db98910a11c12a454eac4c8e86dc7a7bbc764a4

Get alerted when CVE-2016-8637 or the next vulnerability affects your stack