Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3598-1

Опубликовано: 12 авг. 2026
Источник: suse-cvrf

Описание

Security update for dracut

This update for dracut fixes the following issue:

  • CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Список пакетов

SUSE Linux Enterprise Server 12 SP5-LTSS
dracut-044.2-130.1
dracut-fips-044.2-130.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
dracut-044.2-130.1
dracut-fips-044.2-130.1

Ссылки

Описание

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5-LTSS:dracut-044.2-130.1
SUSE Linux Enterprise Server 12 SP5-LTSS:dracut-fips-044.2-130.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:dracut-044.2-130.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:dracut-fips-044.2-130.1
Ссылки
Уязвимость SUSE-SU-2026:3598-1