CyberRota Analysis
AI-GeneratedA vulnerability exists in the dracut NetworkManager-based initrd network module, where improper handling of specially crafted DHCP options can lead to command injection. This flaw allows a remote attacker on an adjacent network to execute arbitrary commands with root privileges during system boot, posing a significant risk to affected systems. Organizations utilizing dracut for their network initialization should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.