Skip to content
Fencer Vulns
medium 5.0

CVE-2016-8637 json

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when '…

published 2018-08-01 8 y ago modified 2026-06-17 4 mo ago also EUVD-2016-9480

cvss
5.0
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.

Patch / fix

  • dracut_project dracut 045
  • dracut Debian 14, Debian 13, Debian 12 044+189-1

debian advisories DEBIAN-CVE-2016-8637

  • dracut Ubuntu Pro 16.04 LTS 044+3-3ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2016-8637

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dracut SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 +1 more 044-108.1
  • dracut SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 037-91.1
  • dracut SLES 12-LTSS 037-51.31.1

suse advisories SUSE-SU-2017:2696-1SUSE-SU-2017:0951-1SUSE-SU-2017:0641-1

  • dracut openSUSE Tumbleweed 044-17.1

opensuse advisories openSUSE-SU-2024:10225-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-8637 updated cvss 5.0

dracut: Local information disclosure of initramfs when early cpio is used

  • Red Hat Enterprise Linux 6 dracut, dracut-caps, dracut-fips, dracut-tools, dracut-kernel, dracut-generic, +2 more Red Hat Enterprise Linux 7 dracut, dracut-caps, dracut-fips, dracut-tools, dracut-network, dracut-fips-aesni, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8637 referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/oss-sec/2016/q4/352 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
NVD 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • The Dracut Project dracut

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.