World-Readable Initrd Vulnerability in Relax-and-Recover (ReaR) Package
Summary
DEBIAN-CVE-2024-23301: Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. Affects rear versions < 2.7+dfsg-1.2. Fixed in 2.7+dfsg-1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Relax-and-Recover (ReaR) is a backup and disaster recovery solution for Linux systems. It facilitates the creation of bootable recovery images and supports various backup methods. The package is widely used in enterprise environments to ensure data integrity and system recoverability. However, a vulnerability has been identified in versions prior to 2.7+dfsg-1.2, which can lead to security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the creation of a world-readable initrd file when the GRUB_RESCUE option is enabled. This misconfiguration allows local attackers to access sensitive system secrets that should only be readable by the root user. The potential ramifications include unauthorized access to critical system information, which could lead to further exploitation or data breaches.
How To Fix
Minimum fixed version
2.7+dfsg-1.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rearTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the GRUB_RESCUE option in their configuration to prevent the creation of a world-readable initrd file. This can be done by editing the configuration file and setting 'GRUB_RESCUE=n'. After making changes, remember to update the GRUB configuration with 'sudo update-grub'.
Conclusion
The Relax-and-Recover (ReaR) package has a critical vulnerability that can expose sensitive system information to local attackers. It is essential for users to update to the patched version 2.7+dfsg-1.2 or later to mitigate this risk. Implementing the recommended workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for rear →
FAQ
The vulnerability allows local attackers to read sensitive information from the initrd file, which could lead to unauthorized access and potential system compromise.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
If immediate updates are not possible, consider disabling the GRUB_RESCUE option as a temporary workaround to mitigate the risk.
No, this vulnerability is present in versions prior to 2.7+dfsg-1.2. Updating to the latest version will resolve the issue.
More information can be found in the official Debian CVE database or by visiting the source link provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for rear.
