Bug 1870056 (CVE-2020-24331)

Summary:	CVE-2020-24331 trousers: tss user still has read and write access to the /etc/tcsd.conf file if tcsd is started as root
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gblomqui, igor.raits, jlyle, jsnitsel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	trousers 0.3.14	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 20:34:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1870057, 1882401, 1882402, 1972196, 1972197
Bug Blocks:	1849039

Description Marian Rehak 2020-08-19 09:40:30 UTC

If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

External Reference:

https://www.openwall.com/lists/oss-security/2020/08/14/1

Comment 1 Marian Rehak 2020-08-19 09:40:54 UTC

Created trousers tracking bugs for this issue:

Affects: fedora-all [bug 1870057]

Comment 2 Marco Benatto 2020-09-24 13:27:04 UTC

Upstream commit for this issue:

https://sourceforge.net/p/trousers/trousers/ci/e74dd1d96753b0538192143adf58d04fcd3b242b/

Comment 4 Marco Benatto 2020-09-24 13:44:38 UTC

There's an issue on trousers. If trousers daemon is started using root user the default, tss unprivileged user still can write to the configuration file due to missing checks at conf_file_init() function. As tcsd.conf holds a set of sensitive configuration entries for the daemon, an attacker can use that to cause DoS, compromise confidentiality or integrity of several system data.

Comment 5 errata-xmlrpc 2021-05-18 13:48:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1627 https://access.redhat.com/errata/RHSA-2021:1627

Comment 6 Product Security DevOps Team 2021-05-18 20:34:44 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-24331