GitHub Advisoryadvisory · Go

GHSA-6w5f-5wgr-qjg5 Constellation allows Emergency shell access during initramfs boot phase

HIGH Published 2023-03-09 Modified 2023-03-09 Official page ↗
Ecosystem
Go
Packages
github.com/edgelesssys/constellation/v2
Severity
High
Reviewed
2023-03-09

Affected packages

• Go github.com/edgelesssys/constellation/v2: < 2.6.0 → fixed in 2.6.0

Description

Impact An active attacker could let the boot fail on purpose in the initramfs, dropping the serial console into an emergency shell. This gives attackers with access to the serial console full control over the VM. Patches The issue has been patched in v2.6.0. Workarounds none

References