Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module
Affects dracut's NetworkManager initrd module on Red Hat Enterprise Linux 6, 7, 8, 9 and 10, plus OpenShift Container Platform. The CVSS score is 7.5 (high), and the fix is dracut-049-223.git20230119.el8_8.1.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in dracut-049-223.git20230119.el8_8.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- dracut
Version range not reported
- dracut
Version range not reported
- dracut
Version range not reported
- dracut
Version range not reported
- dracut
Version range not reported
- dracut
Version range not reported
- dracut
Version range not reported
- rhcos
Version range not reported
- dracut-main
Version range not reported
- dracut
Version range not reported
- dracut
Version range not reported
- dracut
Version range not reported
- dracut
Version range not reported
- dracut
Version range not reported
References 10
access.redhat.com
bugzilla.redhat.com
GitHub · dracutdevs/dracut
Questions about CVE-2026-16445
What does this mean?
DHCP options received during boot are passed unsafely into commands run by the NetworkManager initrd module, so crafted option values can inject commands. An attacker who can do this can gain root code execution inside the initramfs during system boot.Source: access.redhat.com
Am I affected, and how do I check?
The issue is in dracut's NetworkManager initrd module, and the listed products include Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4.12 and 5. To check a system, run rpm -q dracut to see the installed version, and run lsinitrd | grep -i networkmanager to see whether the initramfs includes the NetworkManager module.Source: access.redhat.com
What should I do about it?
Update dracut to dracut-049-223.git20230119.el8_8.1 or a later fixed build from the vendor's errata for your release. No workaround is listed in the facts.Source: access.redhat.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data