Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3599-1

Опубликовано: 12 авг. 2026
Источник: suse-cvrf

Описание

Security update for dracut

This update for dracut fixes the following issue:

Update to version 055+suse.367.g85633e8.

Securitys issue fixed:

  • CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

  • Fix(base): sanitize message written by die() to the emergency hook.
  • Feat(base): add escape function implementing printf %q.

Список пакетов

Container suse/sle-micro-rancher/5.3:latest
dracut-055+suse.367.g85633e8-150400.3.52.1
dracut-mkinitrd-deprecated-055+suse.367.g85633e8-150400.3.52.1
Container suse/sle-micro-rancher/5.4:latest
dracut-055+suse.367.g85633e8-150400.3.52.1
dracut-mkinitrd-deprecated-055+suse.367.g85633e8-150400.3.52.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
dracut-055+suse.367.g85633e8-150400.3.52.1
dracut-fips-055+suse.367.g85633e8-150400.3.52.1
dracut-ima-055+suse.367.g85633e8-150400.3.52.1
dracut-mkinitrd-deprecated-055+suse.367.g85633e8-150400.3.52.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
dracut-055+suse.367.g85633e8-150400.3.52.1
dracut-fips-055+suse.367.g85633e8-150400.3.52.1
dracut-ima-055+suse.367.g85633e8-150400.3.52.1
dracut-mkinitrd-deprecated-055+suse.367.g85633e8-150400.3.52.1
SUSE Linux Enterprise Micro 5.3
dracut-055+suse.367.g85633e8-150400.3.52.1
dracut-fips-055+suse.367.g85633e8-150400.3.52.1
dracut-mkinitrd-deprecated-055+suse.367.g85633e8-150400.3.52.1
SUSE Linux Enterprise Micro 5.4
dracut-055+suse.367.g85633e8-150400.3.52.1
dracut-fips-055+suse.367.g85633e8-150400.3.52.1
dracut-mkinitrd-deprecated-055+suse.367.g85633e8-150400.3.52.1
SUSE Linux Enterprise Server 15 SP4-LTSS
dracut-055+suse.367.g85633e8-150400.3.52.1
dracut-fips-055+suse.367.g85633e8-150400.3.52.1
dracut-ima-055+suse.367.g85633e8-150400.3.52.1
dracut-mkinitrd-deprecated-055+suse.367.g85633e8-150400.3.52.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
dracut-055+suse.367.g85633e8-150400.3.52.1
dracut-fips-055+suse.367.g85633e8-150400.3.52.1
dracut-ima-055+suse.367.g85633e8-150400.3.52.1
dracut-mkinitrd-deprecated-055+suse.367.g85633e8-150400.3.52.1

Ссылки

Описание

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Затронутые продукты
Container suse/sle-micro-rancher/5.3:latest:dracut-055+suse.367.g85633e8-150400.3.52.1
Container suse/sle-micro-rancher/5.3:latest:dracut-mkinitrd-deprecated-055+suse.367.g85633e8-150400.3.52.1
Container suse/sle-micro-rancher/5.4:latest:dracut-055+suse.367.g85633e8-150400.3.52.1
Container suse/sle-micro-rancher/5.4:latest:dracut-mkinitrd-deprecated-055+suse.367.g85633e8-150400.3.52.1
Ссылки
Уязвимость SUSE-SU-2026:3599-1