Pavel Valena

**Name of the Vulnerable Software and Affected Versions** dracut (affected versions not specified) **Description** A flaw exists in the `die()` error-handling function which writes messages into a shell script within the initramfs emergency-hook directory without proper shell-quoting. An attacker on the adjacent network controlling a rogue DHCP server can exploit this by providing malicious data via the DHCP `ROOT PATH` option. This allows the injection of a command-substitution sequence that executes with root privileges when dracut sources its emergency hook scripts during standard boot-failure handling. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dracut (affected versions not specified) **Description** A flaw in the NetworkManager-based initrd network module allows a remote attacker on the adjacent network to achieve root code execution within the initramfs during system boot. The issue occurs when specially crafted DHCP options, such as `root-path`, `next-server`, or `bootfile name`, are improperly handled and written into a temporary shell script without proper escaping, resulting in command injection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.