Bug 1975142 (CVE-2021-3621)

Summary:	CVE-2021-3621 sssd: shell command injection in sssctl
Product:	[Other] Security Response	Reporter:	Cedric Buissart <cbuissar>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abokovoy, atikhono, dblechte, dfediuck, eedri, grajaiya, jhrozek, lslebodn, luk.claes, mgoldboi, michal.skrivanek, mperina, mzidek, nobody, pbrezina, sbonazzo, sbose, security-response-team, sgoveas, sherold, ssorce, sssd-maintainers, sssd-maint, tscherf, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	sssd 2.6.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-08-16 13:28:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1973411, 1975169, 1985454, 1985455, 1985456, 1985457, 1985877, 1985878, 1989830, 1993799, 1993910, 2048284
Bug Blocks:	1975138, 1975969

Description Cedric Buissart 2021-06-23 07:58:30 UTC

`sssctl_run_command()` is a wrapper for running commands via a shell, using glibc's `system()` function call.
`sssctl_cache_expire()` and `sssctl_logs_fetch()` allow user provided arguments, and pass them to `sssctl_run_command()`
sssctl is limited to root user, however, if an administrator allows unprivileged users to provide arguments to the command (e.g.: via sudo), this could be used to elevate privileges via a shell injection.

Although there are no known default configuration where this flaw could be exploited, the admin could have manually created sudo rules to let regular users use sssctl commands, or could be tricked into running a specially crafted sssctl command.

References:

https://sssd.io/release-notes/sssd-2.6.0.html

Comment 20 errata-xmlrpc 2021-08-16 08:44:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3151 https://access.redhat.com/errata/RHSA-2021:3151

Comment 21 Cedric Buissart 2021-08-16 11:54:02 UTC

Created sssd tracking bugs for this issue:

Affects: fedora-all [bug 1993910]

Comment 22 Product Security DevOps Team 2021-08-16 13:28:15 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3621

Comment 23 errata-xmlrpc 2021-08-17 08:30:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:3178 https://access.redhat.com/errata/RHSA-2021:3178

Comment 24 errata-xmlrpc 2021-08-19 15:48:43 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2021:3235 https://access.redhat.com/errata/RHSA-2021:3235

Comment 25 Cedric Buissart 2021-08-23 15:33:06 UTC

Upstream fix :
https://github.com/SSSD/sssd/commit/7ab83f97e1cbefb78ece17232185bdd2985f0bbe

Comment 26 errata-xmlrpc 2021-08-31 09:11:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:3336 https://access.redhat.com/errata/RHSA-2021:3336

Comment 27 errata-xmlrpc 2021-08-31 09:22:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3365 https://access.redhat.com/errata/RHSA-2021:3365

Comment 28 errata-xmlrpc 2021-09-09 09:22:12 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2021:3477 https://access.redhat.com/errata/RHSA-2021:3477