Skip to content

Emergency shell reachable during initramfs boot phase

High
derpsteb published GHSA-6w5f-5wgr-qjg5 Mar 9, 2023

Package

gomod github.com/edgelesssys/constellation/v2 (Go)

Affected versions

< 2.6.0

Patched versions

2.6.0

Description

Impact

An active attacker could let the boot fail on purpose in the initramfs, dropping the serial console into an emergency shell. This gives attackers with access to the serial console full control over the VM.

Patches

The issue has been patched in v2.6.0.

Workarounds

none

Severity

High

CVE ID

No known CVE

Weaknesses

No CWEs