CVE-2008-3895
published 2008-09-03CVE-2008-3895: LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows…
PriorityP45low2.1CVSS 2.0
AVLACLAuNCPINAN
EPSS
0.41%
34.0th percentile
LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Affected
62 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lilo | lilo | <= 22.6.1 | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
| lilo | lilo | — | — |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv2.1LOW
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-38w6-5xg5-v683: LILO 22
ghsa_unreviewed·2022-05-02
CVE-2008-3895 [LOW] CWE-200 GHSA-38w6-5xg5-v683: LILO 22
LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
OSV
CVE-2008-3895: LILO 22
osv·2008-09-03·CVSS 2.1
CVE-2008-3895 [LOW] CVE-2008-3895: LILO 22
LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Red Hat
CVE-2008-3895: LILO 22
vendor_redhat·CVSS 2.1
CVE-2008-3895 [LOW] CVE-2008-3895: LILO 22
LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Statement: Red Hat does not consider this to be a security issue. Since these operations can only be executed by root, no trust boundary is crossed as a result of this behaviour.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://securityreason.com/securityalert/4211http://www.ivizsecurity.com/preboot-patch.htmlhttp://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdfhttp://www.securityfocus.com/archive/1/495801/100/0/threadedhttp://securityreason.com/securityalert/4211http://www.ivizsecurity.com/preboot-patch.htmlhttp://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdfhttp://www.securityfocus.com/archive/1/495801/100/0/threaded
2008-09-03
Published