Emergency Shell Access Vulnerability in Constellation
Summary
GO-2023-1622: Constellation allows Emergency shell access during initramfs boot phase in github.com/edgelesssys/constellation. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Constellation is a Go package developed by edgelesssys that provides emergency shell access during the initramfs boot phase. It is designed to be used in conjunction with other software components to enhance system recovery capabilities. However, a vulnerability has been discovered in Constellation that allows unauthorized access to the emergency shell during the boot phase.
Vulnerability Detail
The vulnerability in Constellation allows an attacker to gain emergency shell access during the initramfs boot phase. This can lead to unauthorized control over the system, potentially resulting in data breaches, privilege escalation, or other malicious activities. The vulnerability affects all versions of Constellation prior to version 2.6.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating to the latest version is not immediately possible, a temporary workaround can be implemented by disabling the emergency shell feature in Constellation. This can be done by modifying the configuration file or removing the relevant code segment responsible for initiating the emergency shell during the boot phase. Here is an example of how to disable the emergency shell feature in the configuration file:
[constellation]
emergency_shell_enabled = false
Please note that this workaround should only be considered as a temporary solution until the package can be updated to a fixed version.
Conclusion
The emergency shell access vulnerability in Constellation poses a significant risk to system security. It is crucial to update the package to version 2.6.0 or later to mitigate this vulnerability. In the meantime, disabling the emergency shell feature can serve as a temporary workaround. Stay vigilant and follow best practices to ensure the security of your systems.
See every vulnerability recorded for github.com/edgelesssys/constellation →
FAQ
Constellation is a Go package developed by edgelesssys that provides emergency shell access during the initramfs boot phase. It is designed to enhance system recovery capabilities.
The vulnerability allows unauthorized access to the emergency shell during the boot phase, potentially leading to data breaches, privilege escalation, or other malicious activities.
All versions of Constellation prior to version 2.6.0 are affected by this vulnerability.
To fix this vulnerability, update Constellation to version 2.6.0 or later by running the command: go get -u github.com/edgelesssys/constellation/v2
Yes, a temporary workaround is to disable the emergency shell feature in Constellation by modifying the configuration file or removing the relevant code segment responsible for initiating the emergency shell during the boot phase.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/edgelesssys/constellation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
