Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3612-1

Опубликовано: 13 авг. 2026
Источник: suse-cvrf

Описание

Security update for dracut

This update for dracut fixes the following issue:

Update to version 059+suse.567.gf5cfeb7f7.

Securitys issue fixed:

  • CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

  • Fix(base): sanitize message written by die() to the emergency hook.
  • Feat(base): add escape function implementing printf %q.

Список пакетов

SUSE Linux Enterprise High Availability Extension 15 SP6
dracut-mkinitrd-deprecated-059+suse.567.gf5cfeb7f7-150600.3.32.1
SUSE Linux Enterprise Server 15 SP6-LTSS
dracut-059+suse.567.gf5cfeb7f7-150600.3.32.1
dracut-fips-059+suse.567.gf5cfeb7f7-150600.3.32.1
dracut-ima-059+suse.567.gf5cfeb7f7-150600.3.32.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6
dracut-059+suse.567.gf5cfeb7f7-150600.3.32.1
dracut-fips-059+suse.567.gf5cfeb7f7-150600.3.32.1
dracut-ima-059+suse.567.gf5cfeb7f7-150600.3.32.1

Ссылки

Описание

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Затронутые продукты
SUSE Linux Enterprise High Availability Extension 15 SP6:dracut-mkinitrd-deprecated-059+suse.567.gf5cfeb7f7-150600.3.32.1
SUSE Linux Enterprise Server 15 SP6-LTSS:dracut-059+suse.567.gf5cfeb7f7-150600.3.32.1
SUSE Linux Enterprise Server 15 SP6-LTSS:dracut-fips-059+suse.567.gf5cfeb7f7-150600.3.32.1
SUSE Linux Enterprise Server 15 SP6-LTSS:dracut-ima-059+suse.567.gf5cfeb7f7-150600.3.32.1
Ссылки
Уязвимость SUSE-SU-2026:3612-1