Bug 1651863 (CVE-2018-19044)

Summary:	CVE-2018-19044 keepalived: Improper pathname validation allows for overwrite of arbitrary filenames via symlinks
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, athmanem, bperkins, chrisw, cluster-maint, markmc, matthias, rbryant, rohara, tdecacqu, thoger
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	keepalived 2.0.9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-06 19:20:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1651864, 1652397, 1654301
Bug Blocks:	1651865

Description Sam Fowler 2018-11-21 05:25:50 UTC

keepalived before version 2.0.9 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.


Upstream Patch:

https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe2750306


Upstream Issue:

https://github.com/acassen/keepalived/issues/1048


Reference:

https://bugzilla.suse.com/show_bug.cgi?id=1015141

Comment 1 Sam Fowler 2018-11-21 05:26:25 UTC

Created keepalived tracking bugs for this issue:

Affects: fedora-all [bug 1651864]

Comment 6 Adam Mariš 2018-11-29 14:19:54 UTC

Statement:

This issue affects the versions of keepalived as shipped with Red Hat Enterprise Linux 6 and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

The keepalived packages shipped with Red Hat Enterprise Linux 6 and 7 are not built with dbus support, therefore vulnerable PrintData and PrintStats methods are not compiled in resulting RPM, which means this issue cannot be exploited via dbus messages on Red Hat Enterprise Linux 6 and 7. However, creation of pidfiles is also vulnerable to symlink attack and it is possible for local attacker to overwrite arbitrary file with the process identifiers of keepalived processes, but only if keepalived was launched with option to change pidfile location pointing to unsafe location and attacker is able to exploit Time-of-check Time-of-use race condition and create a symlink during a very small time frame in the same location the pidfile was specified. The default location used for pidfiles is safe. Red Hat Enterprise Linux 7 is by default configured with fs.protected_symlinks=1 which largely mitigates symlink attacks.

Comment 8 errata-xmlrpc 2019-08-06 12:36:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2285 https://access.redhat.com/errata/RHSA-2019:2285

Comment 9 Product Security DevOps Team 2019-08-06 19:20:11 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-19044