Bug 1856664 (CVE-2020-13882)

Summary: CVE-2020-13882 lynis: incorrect access control because of a TOCTOU race condition
Product: [Other] Security Response Reporter: Dhananjay Arunesh <darunesh>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: athmanem, i, rakesh.pandit
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-14 13:27:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1856665, 1856666    
Bug Blocks:    

Description Dhananjay Arunesh 2020-07-14 07:49:40 UTC
CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.


Comment 1 Dhananjay Arunesh 2020-07-14 07:50:33 UTC
Created lynis tracking bugs for this issue:

Affects: epel-all [bug 1856666]
Affects: fedora-all [bug 1856665]

Comment 2 Product Security DevOps Team 2020-07-14 13:27:56 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.