dracut vulnerabilities

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

A command injection vulnerability in dracut. A remote attacker on the adjacent network can provide crafted DHCP options, leading to code execution in initramfs during system boot.

A flaw in dracut allows a remote attacker on the adjacent network to inject commands via specially crafted DHCP options (e.g., a malicious hostname). These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. The attacker can achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.