On this page (7 sections)
Ubuntu has published USN-8988-1 on 3 November 2026 for Relax-and-Recover (the rear package), a bare metal disaster recovery and system migration framework. The notice says the tool created a world-readable initrd when the GRUB_RESCUE option was enabled, which a local attacker could possibly use to obtain sensitive information.
If you run Ubuntu servers that use rear for backups or recovery, particularly shared hosts where several people or services have local accounts, this is worth a quick check and a routine update.
What the notice says
According to Ubuntu, Relax-and-Recover created an initrd (the initial RAM disk image used during boot) that any local user could read, but only when the GRUB_RESCUE setting was turned on. The notice's impact summary is that rear "could be made to expose sensitive information", and that a local attacker could possibly use the issue to obtain it.
The notice does not say what data ends up in the image, does not give a CVSS score, and does not describe any real-world attacks. Those details are unconfirmed, so treat the severity as unknown rather than assuming it is low or high.
Why a world-readable recovery image matters
A rescue initrd built by a recovery tool is made to bring a machine back from scratch, so it can contain configuration drawn from the live system. File permissions are the only barrier between that content and other local users. When the file is readable by everyone, any account on the machine, including a low-privileged service account or a compromised web application user, can copy it and look for secrets offline.
This is a local issue, not a remote one. An attacker needs some foothold on the host first. On a single-user server that foothold is less likely, but on shared hosting, multi-tenant servers, or a web server where an application flaw could give an attacker a low-privileged shell, it can turn a small compromise into a bigger one.
Who is affected
- Ubuntu 22.04 LTS (jammy), 20.04 LTS (focal) and 18.04 LTS (bionic) systems with the rear package installed.
- Systems where GRUB_RESCUE is enabled in the Relax-and-Recover configuration. The notice ties the problem to that option.
- Hosts with more than one local user or service account, where reading another account's data matters most.
For 20.04 LTS and 18.04 LTS, Ubuntu says the fix is available through Ubuntu Pro via ESM Apps, and that a community fix might become publicly available in the future.
How to check your exposure
This read-only command shows whether rear is installed and which version you have. Run it on each Ubuntu host and compare the result with the fixed versions in the table below.
apt list --installed rear 2>/dev/null| Ubuntu release | Fixed rear version | How to get it |
|---|---|---|
| 22.04 LTS (jammy) | 2.6+dfsg-1+deb11u1build0.22.04.1 | Standard system update |
| 20.04 LTS (focal) | 2.5+dfsg-1ubuntu0.1~esm1 | Ubuntu Pro via ESM Apps |
| 18.04 LTS (bionic) | 2.3+dfsg-1ubuntu0.1~esm1 | Ubuntu Pro via ESM Apps |
Next, see whether GRUB_RESCUE is set in your configuration. This grep only reads files. The /etc/rear directory is the usual location for rear configuration files; if it does not exist on your system, check where your own setup keeps its configuration.
grep -rn "GRUB_RESCUE" /etc/rear/What to do now
Ubuntu states that in general a standard system update makes all the necessary changes. This command refreshes package lists and upgrades only the rear package.
apt-get update && apt-get install --only-upgrade rear0 of 6 done
Monitoring afterwards
Local information leaks like this are easy to miss because they leave no network trace. Keep package versions on your servers under regular review and subscribe to Ubuntu security notices for the releases you run. If you expose web applications on the same hosts, remember that a web flaw is often the first local foothold, so keep those patched too; our guide on small business website security covers the basics.
For the web-facing side, Webforta Scan runs read-only security scans of sites you verify, and Webforta Monitor tracks uptime, certificate, DNS and header changes. Neither can see local file permissions on your server, so package updates and configuration review remain your job.
Similar Ubuntu notices published recently include USN-8987-1 for libuser and USN-8992-1 for Shapelib.
Sourcing note
At the time of writing, this article relies on a single primary source, the Ubuntu notice itself. No CVSS score, exploitation reports or further technical analysis were available, so those details are left out rather than guessed.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.