Description

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T11:17:05.100Z",
  "pubdate": "2026-08-07T11:17:05.100Z",
  "executiveSummary": "A command injection vulnerability has been identified in dracut, specifically within the die() error-handling function. This flaw arises from improper shell-quoting of error messages written to shell scripts under the initramfs emergency-hook directory. Attackers operating a rogue DHCP server on an adjacent network can exploit this weakness by supplying a malicious ROOT_PATH option containing crafted command-substitution sequences. When a target system encounters a boot failure, dracut sources these emergency hook scripts, resulting in the execution of arbitrary commands with root privileges. This vulnerability presents severe risk implications, as it compromises the integrity and confidentiality of the host operating system during the early boot sequence. Exploitation requires the attacker to be positioned on the adjacent network capable of spoofing or controlling DHCP responses to supply the malicious payload. No prior authentication is required, making network adjacency the primary prerequisite for successful exploitation.",
  "technicalDetails": "The vulnerability resides in the error-handling mechanism of the dracut utility, specifically inside the die() function. During execution, die() constructs error messages and writes them directly into a shell script located in the initramfs emergency-hook directory without applying proper shell-quoting mechanisms. The vulnerable component processes input derived from network configuration protocols, notably the DHCP ROOT_PATH option.\nThe attack flow proceeds as follows: 1) An attacker deploys a rogue DHCP server on the adjacent network reachable by the victim system. 2) During the network boot or initialization phase, the victim client requests IP and boot parameters via DHCP. 3) The rogue DHCP server responds with malicious data embedded within the ROOT_PATH option, incorporating shell command-substitution sequences (e.g., backticks or dollar-parenthesis syntax). 4) The dracut environment captures this untrusted data and passes it to the die() function during error handling. 5) The die() function writes the unquoted string into the emergency-hook script file within the initramfs structure. 6) At a later stage, when the system encounters a boot failure, dracut processes and sources the emergency hook scripts. 7) The shell evaluates the injected command-substitution sequence, leading to arbitrary code execution.\nThe execution context operates with root privileges because dracut runs as a critical initramfs component during early userspace initialization. Network exposure is limited to the adjacent network where DHCP traffic can be manipulated or intercepted. Authentication is not required, as standard DHCP transactions lack cryptographic validation by default in vulnerable configurations. Post-exploitation impact includes full root compromise of the local system before the primary operating system finishes booting, allowing attackers to persist payloads, modify filesystem contents, or exfiltrate sensitive data."
}