Dracut

A vulnerability in the dracut initramfs emergency-hook mechanism allows an attacker with access to the local network to perform command injection and achieve root code execution during system boot.

A command injection vulnerability exists in dracut's NetworkManager-based initrd network module that allows a remote attacker on an adjacent network to achieve root code execution within the initramfs during system boot by providing specially crafted DHCP options without proper escaping.