Vulnerability Description
Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image with insecure permissions, which allows this originally protected file to be read by any user, thereby disclosing decryption keys for LUKS containers created with Full Disk Encryption.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Calamares | Calamares | <= 3.2.10 |
Related Weaknesses (CWE)
References
- https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095ExploitIssue TrackingThird Party Advisory
- https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1726542Issue TrackingThird Party Advisory
- https://calamares.io/calamares-3.2.11-is-out/Vendor Advisory
- https://calamares.io/calamares-cve-2019/Vendor Advisory
- https://github.com/calamares/calamares/issues/1191ExploitIssue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095ExploitIssue TrackingThird Party Advisory
- https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1726542Issue TrackingThird Party Advisory
- https://calamares.io/calamares-3.2.11-is-out/Vendor Advisory
- https://calamares.io/calamares-cve-2019/Vendor Advisory
- https://github.com/calamares/calamares/issues/1191ExploitIssue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2019-13179?
CVE-2019-13179 is a vulnerability with a CVSS score of 7.5 (HIGH). Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image with insecure permissions,...
How severe is CVE-2019-13179?
CVE-2019-13179 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-13179?
Check the references section above for vendor advisories and patch information. Affected products include: Calamares Calamares.