CVE-2024-23301

Name of the Vulnerable Software and Affected Versions Relax-and-Recover (aka ReaR) versions 2.7 and earlier

Description The issue is related to information disclosure. It allows local attackers to gain access to system secrets that are otherwise only readable by root. This occurs when using GRUB RESCUE=y, which creates a world-readable initrd.

Recommendations For Relax-and-Recover (aka ReaR) versions 2.7 and earlier, consider disabling the use of GRUB RESCUE=y until a patch is available to prevent the creation of a world-readable initrd. As a temporary workaround, restrict access to sensitive system secrets to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.