CVE-2023-36476 `calamares-nixos-extensions` LUKS keyfile exposure
Attackers can read LUKS keyfiles from the initrd if the boot partition is unencrypted, exposing encrypted data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-36476?
CVE-2023-36476 is a high-severity vulnerability in calamares-nixos-extensions, published on 29 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 and prior who installed NixOS through the graphical calamares installer, with an unencrypted `/boot`, on either non-UEFI systems or with a LUKS partition different from `/` have their LUKS key file in `/boot` as a plaintext CPIO archive attached to their NixOS initrd. A patch is available and anticipated to be part of version 0.3.13 to backport to NixOS 22.11, 23.05, and unstable channels. Expert users who have a copy of their data may, as a workaround, re-encrypt the LUKS partition(s) themselves.
Which versions are affected by CVE-2023-36476?
It affects 1 product.
Products include Nixos Calamares-Nixos-Extensions.
How do I fix CVE-2023-36476?
No fix has been published for CVE-2023-36476 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-36476 being exploited?
There is no known exploitation of CVE-2023-36476 in the wild and no public exploit code.
Sources
Also known as GHSA-3rvf-24q2-24ww.