Bug 1212873

Summary:	abrt: user coredump writer in abrt-hook-ccpp needs to be disabled for fs.suid_dumpable=2
Product:	Red Hat Enterprise Linux 7	Reporter:	Florian Weimer <fweimer>
Component:	abrt	Assignee:	abrt <abrt-devel-list>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE - Apps <qe-baseos-apps>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.1	CC:	fweimer, jfilak, mbrysa
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-09 08:11:36 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1211224, 1214172

Description Florian Weimer 2015-04-17 14:52:19 UTC

If fs.suid_dumpable=2, then the abrt-addon-ccpp has this bug:

  <http://lwn.net/Articles/503682/>

On the kernel side, this was mitigated by disabling user coredumps in this mode, and I do not see any alternative.

If this mode is active, local users can escalate their privileges to root by abusing the abrt-hook-ccpp user coredump writer.

fs.suid_dumpable=2 is not default, and this mode is generally considered risky.  Therefore, we do not consider this issue a security vulnerability.

Comment 7 Marek Bryša 2015-07-09 08:11:36 UTC

This is fixed via BZ#1212820.