Bug 1789640 (CVE-2020-1690)

Summary:	CVE-2020-1690 openstack-selinux: policy flaw allows dbus messaging
Product:	[Other] Security Response	Reporter:	Summer Long <slong>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cjeanner, dbecker, hrybacki, jjoyce, jpichon, jschluet, lhh, lpeer, lvrabec, mburns, mmagr, nkinder, sclewis, security-response-team, slinaber, zcaplovi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openstack-selinux 0.8.24	Doc Type:	If docs needed, set a value
Doc Text:	An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack (RHOSP) containers could send messages to the dbus. With access to the dbus, the attacker could start or stop services, possibly causing a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-10-28 20:21:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1790116, 1790117, 1803657, 1877863, 1877864
Bug Blocks:	1788675

Description Summer Long 2020-01-10 00:22:29 UTC

As of 15, openstack-selinux prevents a non-root user in a container from privilege escalation. In 13 and before, openstack-selinux didn't have this functionality (that is, selinux separation wasn't possible).
Updates to the policy in [1] broke 15's functionality.  A non-root user in one or more RHOSP containers can send messages to the dbus. With access to the dbus, services could be started or stopped, therefore a DoS is possible.

Comment 3 Summer Long 2020-01-10 00:28:41 UTC

For Comment #0: [1] https://bugzilla.redhat.com/show_bug.cgi?id=1738134
Matching BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1788561

Comment 6 Summer Long 2020-01-11 22:43:24 UTC

Acknowledgments:

Name: Cedric Jeanneret (Red Hat)

Comment 17 Summer Long 2020-02-17 07:22:40 UTC

Created openstack-selinux tracking bugs for this issue:

Affects: openstack-rdo [bug 1803657]

Comment 18 Summer Long 2020-02-17 23:55:59 UTC

Mitigation:

There is no known mitigation for this issue, the flaw can only be resolved by applying updates.

Comment 25 errata-xmlrpc 2020-10-28 15:46:28 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2020:4381 https://access.redhat.com/errata/RHSA-2020:4381

Comment 26 Product Security DevOps Team 2020-10-28 20:21:20 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-1690