Bug 1670633 (CVE-2018-18505)

Summary: CVE-2018-18505 Mozilla: Privilege escalation through IPC channel messages
Product: [Other] Security Response Reporter: Doran Moppert <dmoppert>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: cschalle, gecko-bugs-nobody, jhorak, stransky, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:46:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1668153, 1668154, 1668155, 1668156, 1670636, 1670637, 1670638, 1670639, 1670640    
Bug Blocks: 1668151, 1670486    

Description Doran Moppert 2019-01-29 23:18:56 UTC 
An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process.



External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2019-02/#CVE-2018-18505
Comment 1 Doran Moppert 2019-01-29 23:18:59 UTC 
Acknowledgments:

Name: the Mozilla project
Upstream: Jed Davis
Comment 7 errata-xmlrpc 2019-01-30 17:38:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:0218 https://access.redhat.com/errata/RHSA-2019:0218
Comment 8 errata-xmlrpc 2019-01-30 17:56:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0219 https://access.redhat.com/errata/RHSA-2019:0219
Comment 9 errata-xmlrpc 2019-02-04 20:41:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:0269 https://access.redhat.com/errata/RHSA-2019:0269
Comment 10 errata-xmlrpc 2019-02-04 20:42:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0270 https://access.redhat.com/errata/RHSA-2019:0270