GHSA-6w5f-5wgr-qjg5 Constellation allows Emergency shell access during initramfs boot phase
An attacker with serial console access can force a boot failure to gain root control via an emergency shell in Constellation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-6w5f-5wgr-qjg5?
GHSA-6w5f-5wgr-qjg5 is an authentication bypass vulnerability in github.com/edgelesssys/constellation, published on 9 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Impact
An active attacker could let the boot fail on purpose in the initramfs, dropping the serial console into an emergency shell. This gives attackers with access to the serial console full control over the VM.
Patches
The issue has been patched in v2.6.0.
Workarounds
none
Which versions are affected by GHSA-6w5f-5wgr-qjg5?
4 open source packages ship an affected version, including github.com/edgelesssys/constellation/v2 and github.com/edgelesssys/constellation.
| Package | Affected | Fixed in |
|---|---|---|
github.com/edgelesssys/constellation/v2 Go | All versions | 2.6.0 |
github.com/edgelesssys/constellation/v2 Go | All versions | 2.6.0 |
github.com/edgelesssys/constellation/v2 Go | All versions | 2.6.0 |
github.com/edgelesssys/constellation Go | All versions | None |
How do I fix GHSA-6w5f-5wgr-qjg5?
Upgrade github.com/edgelesssys/constellation/v2 to 2.6.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-6w5f-5wgr-qjg5 being exploited?
There is no known exploitation of GHSA-6w5f-5wgr-qjg5 in the wild and no public exploit code.
Sources
Also known as GO-2023-1622.