Live Boot
Monthly
live-boot at commit ff8867c silently skips dm-verity root hash signature verification when the .verity file is absent from the live medium, allowing a physically present attacker to boot a tampered or unsigned root filesystem image that bypasses integrity enforcement. The flaw undermines the dm-verity-enforce-roothash-signature kernel protection intended to guarantee boot-time filesystem authenticity on Debian live systems. No public exploit code has been identified at time of analysis; the CVSS 4.0 physical-access vector (AV:P) and attack-requirement condition (AT:P) significantly constrain real-world exploitability.
live-boot at commit ff8867c silently skips dm-verity root hash signature verification when the .verity file is absent from the live medium, allowing a physically present attacker to boot a tampered or unsigned root filesystem image that bypasses integrity enforcement. The flaw undermines the dm-verity-enforce-roothash-signature kernel protection intended to guarantee boot-time filesystem authenticity on Debian live systems. No public exploit code has been identified at time of analysis; the CVSS 4.0 physical-access vector (AV:P) and attack-requirement condition (AT:P) significantly constrain real-world exploitability.