Bug 1690897 (CVE-2019-9893)

Summary:	CVE-2019-9893 libseccomp: incorrect generation of syscall filters in libseccomp
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bmcclain, paul
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libseccomp 2.4.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-06 00:52:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1688905, 1690898, 1695194, 1695195
Bug Blocks:	1690899

Description Dhananjay Arunesh 2019-03-20 12:29:14 UTC

A security issue was discovered in current versions of libseccomp where the library did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE).It would appear that only systemd and Tor are using libseccomp in such a way as to trigger the bad code.  In the case of systemd this appears to affect the socket address family and scheduling class filters.  In the case of Tor it appears that the bad filters could impact the memory addresses passed to mprotect(2).

Reference:
https://www.openwall.com/lists/oss-security/2019/03/15/1

Commits:
https://github.com/seccomp/libseccomp/commit/c5bf78de480b32b324e0f511c88ce533ed280b37
https://github.com/seccomp/libseccomp/commit/cf5d1538d243fb6f1839db70b69469d3d7e9e077
https://github.com/seccomp/libseccomp/commit/2878b8ba7859cf1771795ebef5c85ec211756dca
https://github.com/seccomp/libseccomp/commit/3da42d78e26cd16282bee85fcd817115b7f91af0
https://github.com/seccomp/libseccomp/commit/b29eda913b11ca339a7c1727fdc7e3309dd2a9b6

Comment 1 Dhananjay Arunesh 2019-03-20 12:29:29 UTC

Created libseccomp tracking bugs for this issue:

Affects: fedora-all [bug 1690898]

Comment 2 Paul Moore 2019-03-20 14:24:45 UTC

A libseccomp v2.4.0 package was released for F30, F29, and F28 using the BZs below:

- F30
* https://bugzilla.redhat.com/show_bug.cgi?id=1688903

- F29
* https://bugzilla.redhat.com/show_bug.cgi?id=1688905

- F28 
* https://bugzilla.redhat.com/show_bug.cgi?id=1688906

Comment 3 Riccardo Schirone 2019-03-27 10:23:48 UTC

Upstream issue:
https://github.com/seccomp/libseccomp/issues/139

Comment 5 Riccardo Schirone 2019-03-28 11:35:52 UTC

Incrementing the Impact of the flaw to Important because those kind of vulnerable libseccomp's filters are used by systemd when restricting address families and they could be exploited to access families that should not be allowed. Moreover, they may be used by other packages as well.

Comment 8 Riccardo Schirone 2019-04-01 12:09:22 UTC

Keeping the Impact of the flaw to Moderate as, after more analysis and feedback, this cannot be exploited directly and it doesn't have a direct impact on the shipped packages (systemd, flatpak, docker, etc.). An attacker would need to compromise a program/service first and then abuse the loose libseccomp filter somehow to get some advantages.

Comment 11 Riccardo Schirone 2019-04-02 17:35:37 UTC

When comparisons like SCMP_CMP_GE, SCMP_CMP_GT, SCMP_CMP_LE, SCMP_CMP_LT are used in a seccomp filter, the generated code does not properly checks the values and it allows some values that should instead be blocked.

Comment 12 errata-xmlrpc 2019-11-05 21:20:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3624 https://access.redhat.com/errata/RHSA-2019:3624

Comment 13 Product Security DevOps Team 2019-11-06 00:52:29 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-9893