Bug 1793305 (CVE-2020-1704)

Summary: CVE-2020-1704 openshift-service-mesh/kiali-rhel7-operator: /etc/passwd is given incorrect privileges
Product: [Other] Security Response Reporter: Mark Cooper <mcooper>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: kconner, rcernich, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: openshift-istio-kiali-rhel7-operator-container 1.12.12-2 Doc Type: If docs needed, set a value
Doc Text:
An insecure modification vulnerability in the /etc/passwd file was found in the openshift-service-mesh/kiali-rhel7-operator. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-06-02 17:20:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1776664    

Description Mark Cooper 2020-01-21 06:37:00 UTC
It has been found that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/istio-kiali-rhel7-operator-container.

Original bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1791534

Comment 1 Mark Cooper 2020-01-21 06:37:02 UTC
Statement:

By default this vulnerability is not exploitable in un-privilieged containers running on OpenShift Container Platform. This is because the system call SETUID and SETGID is blocked by the default seccomp policy.

Comment 4 Mark Cooper 2020-01-22 03:23:04 UTC
Acknowledgments:

Name: Joseph LaMagna-Reiter (SPR Inc.)

Comment 6 errata-xmlrpc 2020-06-02 16:33:30 UTC
This issue has been addressed in the following products:

  Openshift Service Mesh 1.1

Via RHSA-2020:2369 https://access.redhat.com/errata/RHSA-2020:2369

Comment 7 Product Security DevOps Team 2020-06-02 17:20:29 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-1704