CVE-2016-8637

7.8 highEPSS 0.3%

High (7.8) in dracut project dracut. EPSS 0.3% chance of exploitation in the next 30 days.

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.

Severity

CVSS 3.0

7.8 high

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWEs: CWE-732, CWE-200
Published: 2018-08-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dracut_project:dracut

References

http://seclists.org/oss-sec/2016/q4/352
http://www.securityfocus.com/bid/94128
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8637
https://github.com/dracutdevs/dracut/commit/0db98910a11c12a454eac4c8e86dc7a7bbc764a4
http://seclists.org/oss-sec/2016/q4/352

Check your stack JSON