Relax-and-Recover vulnerability exposes sensitive data via world-readable initrd
A local attacker can access sensitive information because Relax-and-Recover creates world-readable initial RAM disks when GRUB_RESCUE is enabled.
Summary
Canonical has issued a security advisory regarding a vulnerability in the Relax-and-Recover (ReaR) bare metal disaster recovery framework. The flaw involves the creation of an initial RAM disk (initrd) with world-readable permissions when the GRUB_RESCUE feature is active.
This vulnerability, tracked as CVE-2024-23301, allows a local attacker to potentially access sensitive information contained within the initrd. Fixes are available for Ubuntu 22.04 LTS, 20.04 LTS, and 18.04 LTS, though some older releases require Ubuntu Pro/ESM Apps for the update.
Technical details of CVE-2024-23301
- Defect Class: Information disclosure resulting from improper file permissions on the generated initrd.
- Attack Vector: Local access is required to exploit the world-readable permissions of the recovery image.
- Affected Component: The Relax-and-Recover (rear) package specifically when the GRUB_RESCUE configuration is enabled.
- Mitigation: Users should update to the patched versions: 2.6+dfsg-1+deb11u1build0.22.04.1 for Jammy or the respective ESM versions for Focal and Bionic.
Why it matters
System administrators using Relax-and-Recover for bare metal disaster recovery must ensure the framework is patched to prevent local users from harvesting sensitive data from recovery images. This highlights the importance of securing disaster recovery tools that handle system-level configurations and credentials.
Original reference: ubuntu.com →