Unscored severity · published Sep 3, 2008
CVE-2008-3895
LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to…
–
CVSS
0.4%
EPSS
No
On KEV
Description
LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Lilo · Lilo
through 22.6.1; 0; 1; 2; 3; 4; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3895
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3895
www.ivizsecurity.com
http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
securityreason.com
http://securityreason.com/securityalert/4211
www.ivizsecurity.com
http://www.ivizsecurity.com/preboot-patch.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/495801/100/0/threaded
More from Lilo
4.3
CVE-2011-1934
lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1