CVE-2016-8637

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732 CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Aug 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-86389.1A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log CVE-2016-86395.4It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker wit CVE-2016-86409.1A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table CVE-2016-86417.8A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely ch CVE-2016-86425.3In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.CVE-2016-86434.3In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.CVE-2016-86445.3In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.CVE-2016-86455.5The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system cra CVE-2016-86465.5The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by a CVE-2016-86474.9An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in CVE-2016-86487.2It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via CVE-2016-86499.1lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descript