CVE-2023-36476

Public Exploit
`calamares-nixos-extensions` LUKS keyfile exposure

Description

calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 and prior who installed NixOS through the graphical calamares installer, with an unencrypted `/boot`, on either non-UEFI systems or with a LUKS partition different from `/` have their LUKS key file in `/boot` as a plaintext CPIO archive attached to their NixOS initrd. A patch is available and anticipated to be part of version 0.3.13 to backport to NixOS 22.11, 23.05, and unstable channels. Expert users who have a copy of their data may, as a workaround, re-encrypt the LUKS partition(s) themselves.

Categories

7.9
CVSS
Severity: High
CVSS 3.1 •
EPSS 0.16%
Vendor Advisory github.com
Affected: NixOS calamares-nixos-extensions
Published at:
Updated at:

References

Link Tags
https://github.com/NixOS/calamares-nixos-extensions/security/advisories/GHSA-3rvf-24q2-24ww mitigation vendor advisory
https://github.com/osresearch/heads/issues/1348 issue tracking exploit
https://github.com/vlinkz/calamares-nixos-extensions/commit/837ca4da5521a74d3b5ca6f7b88890a6713faa22 patch

Frequently Asked Questions

What is the severity of CVE-2023-36476?
CVE-2023-36476 has been scored as a high severity vulnerability.
How to fix CVE-2023-36476?
To fix CVE-2023-36476, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-36476 being actively exploited in the wild?
It is possible that CVE-2023-36476 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-36476?
CVE-2023-36476 affects NixOS calamares-nixos-extensions.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.