CVE-2008-3895
Summary
| CVE | CVE-2008-3895 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2008-09-03 14:12:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:L/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Lilo | Lilo | 0 | All | All | All |
| Application | Lilo | Lilo | 1 | All | All | All |
| Application | Lilo | Lilo | 10 | All | All | All |
| Application | Lilo | Lilo | 11 | All | All | All |
| Application | Lilo | Lilo | 12 | All | All | All |
| Application | Lilo | Lilo | 13 | All | All | All |
| Application | Lilo | Lilo | 14 | All | All | All |
| Application | Lilo | Lilo | 15 | All | All | All |
| Application | Lilo | Lilo | 16 | All | All | All |
| Application | Lilo | Lilo | 17 | All | All | All |
| Application | Lilo | Lilo | 18 | All | All | All |
| Application | Lilo | Lilo | 19 | All | All | All |
| Application | Lilo | Lilo | 2 | All | All | All |
| Application | Lilo | Lilo | 20 | All | All | All |
| Application | Lilo | Lilo | 21 | All | All | All |
| Application | Lilo | Lilo | 21-3 | All | All | All |
| Application | Lilo | Lilo | 21.4.2 | All | All | All |
| Application | Lilo | Lilo | 21.4.3 | All | All | All |
| Application | Lilo | Lilo | 21.4.4 | All | All | All |
| Application | Lilo | Lilo | 21.5 | All | All | All |
| Application | Lilo | Lilo | 21.5.1 | All | All | All |
| Application | Lilo | Lilo | 21.6 | All | All | All |
| Application | Lilo | Lilo | 21.6.1 | All | All | All |
| Application | Lilo | Lilo | 21.7 | All | All | All |
| Application | Lilo | Lilo | 21.7.1 | All | All | All |
| Application | Lilo | Lilo | 21.7.2 | All | All | All |
| Application | Lilo | Lilo | 21.7.3 | All | All | All |
| Application | Lilo | Lilo | 21.7.4 | All | All | All |
| Application | Lilo | Lilo | 21.7.5 | All | All | All |
| Application | Lilo | Lilo | 22.0 | All | All | All |
| Application | Lilo | Lilo | 22.0.1 | All | All | All |
| Application | Lilo | Lilo | 22.0.2 | All | All | All |
| Application | Lilo | Lilo | 22.1 | All | All | All |
| Application | Lilo | Lilo | 22.2 | All | All | All |
| Application | Lilo | Lilo | 22.3 | All | All | All |
| Application | Lilo | Lilo | 22.3.1 | All | All | All |
| Application | Lilo | Lilo | 22.3.2 | All | All | All |
| Application | Lilo | Lilo | 22.3.3 | All | All | All |
| Application | Lilo | Lilo | 22.3.4 | All | All | All |
| Application | Lilo | Lilo | 22.4 | All | All | All |
| Application | Lilo | Lilo | 22.4.1 | All | All | All |
| Application | Lilo | Lilo | 22.5 | All | All | All |
| Application | Lilo | Lilo | 22.5.1 | All | All | All |
| Application | Lilo | Lilo | 22.5.2 | All | All | All |
| Application | Lilo | Lilo | 22.5.3 | All | All | All |
| Application | Lilo | Lilo | 22.5.3.1 | All | All | All |
| Application | Lilo | Lilo | 22.5.4 | All | All | All |
| Application | Lilo | Lilo | 22.5.5 | All | All | All |
| Application | Lilo | Lilo | 22.5.6 | All | All | All |
| Application | Lilo | Lilo | 22.5.7 | All | All | All |
| Application | Lilo | Lilo | 22.5.7.2 | All | All | All |
| Application | Lilo | Lilo | 22.5.8 | All | All | All |
| Application | Lilo | Lilo | 22.5.9 | All | All | All |
| Application | Lilo | Lilo | 22.6 | All | All | All |
| Application | Lilo | Lilo | 3 | All | All | All |
| Application | Lilo | Lilo | 4 | All | All | All |
| Application | Lilo | Lilo | 5 | All | All | All |
| Application | Lilo | Lilo | 6 | All | All | All |
| Application | Lilo | Lilo | 7 | All | All | All |
| Application | Lilo | Lilo | 8 | All | All | All |
| Application | Lilo | Lilo | 9 | All | All | All |
| Application | Lilo | Lilo | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| iViZ - On Demand Automated Penetration Testing | af854a3a-2127-422b-91ae-364da2661108 | www.ivizsecurity.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| SecurityReason - LILO Security Model bypass exploiting wrong BIOS API usage | af854a3a-2127-422b-91ae-364da2661108 | securityreason.com | |
| www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf | af854a3a-2127-422b-91ae-364da2661108 | www.ivizsecurity.com | Exploit |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2009-01-29 | Joshua Bressers | Red Hat does not consider this to be a security issue. Since these operations can only be executed by root, no trust boundary is crossed as a result of this behaviour. |
There are currently no legacy QID mappings associated with this CVE.