Bug 1793286 (CVE-2019-19348)

Summary: CVE-2019-19348 openshift/apb-base: /etc/passwd is given incorrect privileges
Product: [Other] Security Response Reporter: Mark Cooper <mcooper>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aos-bugs, bmontgom, eparis, jburrell, jokerman, nstielau, security-response-team, shurley, sponnaga
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: openshift-enterprise-apb-base-container 4.3.5-202003020549, openshift-enterprise-apb-base-container 4.2.21-202002240343, openshift-enterprise-apb-base-container 4.1.37-202003021622, openshift-enterprise-apb-base-container 3.11.188-4 Doc Type: If docs needed, set a value
Doc Text:
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the following 4.3.5, 4.2.21, 4.1.37, and 3.11.188-4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-04 16:33:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1793333, 1793334, 1793335, 1793336    
Bug Blocks: 1776664    

Description Mark Cooper 2020-01-21 04:49:11 UTC
It has been found that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/apb-base-container.

Original bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1791534

Comment 1 Mark Cooper 2020-01-21 04:49:14 UTC
Statement:

By default this vulnerability is not exploitable in un-privilieged containers running on OpenShift Container Platform. This is because the system call SETUID and SETGID is blocked by the default seccomp policy.

Comment 4 Mark Cooper 2020-01-22 03:20:20 UTC
Acknowledgments:

Name: Joseph LaMagna-Reiter (SPR Inc.)

Comment 6 errata-xmlrpc 2020-03-04 05:48:23 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.2

Via RHSA-2020:0617 https://access.redhat.com/errata/RHSA-2020:0617

Comment 7 Product Security DevOps Team 2020-03-04 16:33:16 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19348

Comment 8 errata-xmlrpc 2020-03-10 23:56:51 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.3

Via RHSA-2020:0681 https://access.redhat.com/errata/RHSA-2020:0681

Comment 9 errata-xmlrpc 2020-03-12 21:15:53 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2020:0694 https://access.redhat.com/errata/RHSA-2020:0694

Comment 10 errata-xmlrpc 2020-03-20 00:26:34 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHSA-2020:0796 https://access.redhat.com/errata/RHSA-2020:0796