CVE-2008-3895

LILO < 22.6.1 - Unauthenticated Exposure of Sensitive Information via BIOS Keyboard Buffer

Title source: llm
STIX 2.1

Description

LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

References (4)

Core 4
Core References
Various Sources x_refsource_misc
http://www.ivizsecurity.com/preboot-patch.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/495801/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4211

Scores

EPSS 0.0041
EPSS Percentile 33.2%

Details

CWE
CWE-200
Status published
Products (50)
lilo/lilo 0
lilo/lilo 1
lilo/lilo 2
lilo/lilo 3
lilo/lilo 4
lilo/lilo 5
lilo/lilo 6
lilo/lilo 7
lilo/lilo 8
lilo/lilo 9
... and 40 more
Published Sep 03, 2008
Tracked Since Feb 18, 2026