CVE-2023-36476

High

Description

calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 and prior who installed NixOS through the graphical calamares installer, with an unencrypted `/boot`, on either non-UEFI systems or with a LUKS partition different from `/` have their LUKS key file in `/boot` as a plaintext CPIO archive attached to their NixOS initrd. A patch is available and anticipated to be part of version 0.3.13 to backport to NixOS 22.11, 23.05, and unstable channels. Expert users who have a copy of their data may, as a workaround, re-encrypt the LUKS partition(s) themselves.

SeverityHigh

CVSS7.9

Exploit probability—

ProductCalamares-nixos-extensions

PublishedJun 29, 2023

First seenJun 29, 2023

Weakness typeCWE-200Sensitive information exposure

How to fix

Update

nixos calamares-nixos-extensions0.3.13 or later

Affected products

Product	Affected versions	Fixed in
nixos calamares-nixos-extensions	v < 0.3.13	0.3.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.