Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3613-1

Опубликовано: 13 авг. 2026
Источник: suse-cvrf

Описание

Security update for dracut

This update for dracut fixes the following issue:

Update to version 059+suse.572.g753fdae1b.

Securitys issue fixed:

  • CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

  • Fix(base): sanitize message written by die() to the emergency hook.
  • Feat(base): add escape function implementing printf %q.

Список пакетов

SUSE Linux Enterprise High Availability Extension 15 SP7
dracut-mkinitrd-deprecated-059+suse.572.g753fdae1b-150700.3.20.1
SUSE Linux Enterprise Module for Basesystem 15 SP7
dracut-059+suse.572.g753fdae1b-150700.3.20.1
dracut-fips-059+suse.572.g753fdae1b-150700.3.20.1
dracut-ima-059+suse.572.g753fdae1b-150700.3.20.1

Ссылки

Описание

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Затронутые продукты
SUSE Linux Enterprise High Availability Extension 15 SP7:dracut-mkinitrd-deprecated-059+suse.572.g753fdae1b-150700.3.20.1
SUSE Linux Enterprise Module for Basesystem 15 SP7:dracut-059+suse.572.g753fdae1b-150700.3.20.1
SUSE Linux Enterprise Module for Basesystem 15 SP7:dracut-fips-059+suse.572.g753fdae1b-150700.3.20.1
SUSE Linux Enterprise Module for Basesystem 15 SP7:dracut-ima-059+suse.572.g753fdae1b-150700.3.20.1
Ссылки