CVE-2023-36476

    Dashboard / Vulnerabilities / CVE-2023-36476

    CVE-2023-36476

    Published: 29 Jun 2023Last Modified: 12 Aug 2026

    Summary: `calamares-nixos-extensions` LUKS keyfile exposure

    Details: calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 and prior who installed NixOS through the graphical calamares installer, with an unencrypted `/boot`, on either non-UEFI systems or with a LUKS partition different from `/` have their LUKS key file in `/boot` as a plaintext CPIO archive attached to their NixOS initrd. A patch is available and anticipated to be part of version 0.3.13 to backport to NixOS 22.11, 23.05, and unstable channels. Expert users who have a copy of their data may, as a workaround, re-encrypt the LUKS partition(s) themselves.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36476.json, https://github.com/NixOS/calamares-nixos-extensions/security/advisories/GHSA-3rvf-24q2-24ww, https://nvd.nist.gov/vuln/detail/CVE-2023-36476, https://github.com/osresearch/heads/issues/1348, https://github.com/vlinkz/calamares-nixos-extensions/commit/837ca4da5521a74d3b5ca6f7b88890a6713faa22

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d06ae23dbd71305e82d41778daa7dbb6ece124dc

    Affected versions

    0.3.12
    0.3.11
    0.3.10
    0.3.9
    0.3.8
    0.3.7
    0.3.6
    0.3.5
    0.3.4
    0.3.3
    0.3.2
    0.3.1
    0.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-36476 | CVE-DB