CVE-2019-13179

Vulnerability

Calamares versions 3.1 through 3.2.10 (inclusive) generate a LUKS encryption keyfile at /crypto_keyfile.bin with permissions 0600 owned by root. During installation, this keyfile is copied into the initramfs image stored in /boot, but the initramfs is created with globally readable permissions (e.g., 644). As a result, the keyfile becomes readable by any user on the system, despite its original restrictive permissions [1][2][4].

Exploitation

An attacker with local unprivileged shell access can extract the keyfile by decompressing the initramfs image. For example, using unmkinitramfs /boot/initrd.img-* /tmp/initrd and then copying /tmp/initrd/main/crypto_keyfile.bin to a readable location [2][4]. No authentication beyond a local user account is required; the attack works every time the system is booted with the vulnerable initramfs.

Impact

Successful exploitation discloses the LUKS decryption key for the encrypted root filesystem. An attacker can then decrypt the entire disk, gaining full access to all data, including sensitive files and credentials. This compromises the confidentiality of the entire system, bypassing full-disk encryption [1][2][4].

Mitigation

The vulnerability is fixed in Calamares version 3.2.11, released on July 7, 2019 [3]. Users should update to Calamares 3.2.11 or later. For systems already installed with a vulnerable version, the initramfs must be regenerated with corrected permissions (e.g., by reinstalling the initramfs-tools package or rebuilding the initrd with proper umask). No workaround is available for the installer itself; the fix ensures the initramfs is created with secure permissions [1][3].