Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02dzVmLTV3Z3ItcWpnNc4AAyA1

Constellation allows Emergency shell access during initramfs boot phase

Impact

An active attacker could let the boot fail on purpose in the initramfs, dropping the serial console into an emergency shell. This gives attackers with access to the serial console full control over the VM.

Patches

The issue has been patched in v2.6.0.

Workarounds

none

Permalink: https://github.com/advisories/GHSA-6w5f-5wgr-qjg5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02dzVmLTV3Z3ItcWpnNc4AAyA1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

Identifiers: GHSA-6w5f-5wgr-qjg5
References:

• https://github.com/edgelesssys/constellation/security/advisories/GHSA-6w5f-5wgr-qjg5
• https://github.com/edgelesssys/constellation/releases/tag/v2.6.0
• https://github.com/advisories/GHSA-6w5f-5wgr-qjg5

Repository: https://github.com/edgelesssys/constellation
Blast Radius: 0.0

Affected Packages