Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2026-26534

Опубликовано: 17 июн. 2026
Источник: oracle-oval
Платформа: Oracle Linux 8

Описание

ELSA-2026-26534: dracut security update (IMPORTANT)

[049-244.git20260529.0.1]

  • Refactor get_ucode_file [Orabug: 36989953]
  • Revert the fixes for bugs 33676753 and 33888951 due to regressions [Orabug: 35656614]
  • Fix typo in orabug33888951-dracut-Enable-the-code-to-create-ifcfg-file.patch [Orabug: 35268918]
  • Enable the code to create ifcfg file [Orabug: 33888951]
  • Skip parse iscsiroot.sh on PV VMs [Orabug: 33676753]
  • Add blk_mq_alloc_disk and blk_cleanup_disk to blockfuncs [Orabug: 33603682]
  • Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
  • Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
  • Restore 51-dracut-rescue-postinst.sh for anaconda compatibility
  • Install missing 68-del-part-node.rules [Orabug: 32827579]
  • Add manpage for single-dhcp [Orabug 32201686]
  • Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
  • Use pgrep in dhcp-multi.sh to make efficient and error free [Orabug 32254008]
  • Send DHCP request in parallel on all interfaces for 80% boot time improvement [Orabug: 32034110]
  • Revert fix for [Orabug: 31404167]
  • drop 51-dracut-rescue.install patch
  • Send DHCP query only on min BDF device to improve boot times by 50-60 secs [Orabug: 31404167]
  • add ofb and cts to 01fips kernel module list [Orabug: 30622737]
  • dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
  • Fix kernel-core POSTTRANS script issues with kernel command line [Orabug: 29542203]
  • Update list of necessary files after squashfs execution [Orabug: 29864620]
  • Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
  • Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
  • Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
  • Fix BOOTPROTO calculation for iscsi [Orabug: 29518713]
  • Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
  • 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
  • Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
  • add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

[049-244.git20260529]

  • fix(network-manager): escape DHCP lease values in dhcpopts
  • fix(network-legacy): replace echo writes with printf to
  • fix(iscsi): replace echo writes with printf to prevent
  • fix(network): warn on suspicious shell metacharacters in
  • fix(base): escape arguments in initqueue hook script

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

dracut

049-244.git20260529.0.1.el8_10

dracut-caps

049-244.git20260529.0.1.el8_10

dracut-config-generic

049-244.git20260529.0.1.el8_10

dracut-config-rescue

049-244.git20260529.0.1.el8_10

dracut-live

049-244.git20260529.0.1.el8_10

dracut-network

049-244.git20260529.0.1.el8_10

dracut-squash

049-244.git20260529.0.1.el8_10

dracut-tools

049-244.git20260529.0.1.el8_10

Oracle Linux x86_64

dracut

049-244.git20260529.0.1.el8_10

dracut-caps

049-244.git20260529.0.1.el8_10

dracut-config-generic

049-244.git20260529.0.1.el8_10

dracut-config-rescue

049-244.git20260529.0.1.el8_10

dracut-live

049-244.git20260529.0.1.el8_10

dracut-network

049-244.git20260529.0.1.el8_10

dracut-squash

049-244.git20260529.0.1.el8_10

dracut-tools

049-244.git20260529.0.1.el8_10

Связанные CVE

Связанные уязвимости

CVSS3: 7.5
ubuntu
около 2 месяцев назад

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

CVSS3: 7.5
redhat
около 2 месяцев назад

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

CVSS3: 7.5
nvd
около 2 месяцев назад

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

msrc
около 2 месяцев назад

Dracut: dracut: root code execution via dhcp options command injection

CVSS3: 7.5
debian
около 2 месяцев назад

A flaw was found in dracut. A remote attacker on the adjacent network ...