Bug 1871217 (CVE-2020-24612)
| Summary: | CVE-2020-24612 selinux-policy: SELinux prevents pam-u2f to work correctly, disabling the 2nd factor during authentication | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Cedric Buissart <cbuissar> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED UPSTREAM | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dwalsh, grepl.miroslav, lvrabec, mmalik, plautrba, vmojzis, zpytela |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
It was found that when SELinux works in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with 'nouserok' option, which is the default when configured with the authselect tool, if that file cannot be read, the 2nd factor is disabled. So in such a configuration, an attacker with only the knowledge of the password can log in without the need for the 2nd factor.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-08-21 21:15:20 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1860888, 1871219 | ||
| Bug Blocks: | 1861064 | ||
|
Description
Cedric Buissart
2020-08-21 15:56:02 UTC
Mitigation: To manually permit the read of the config file, the file's SELinux context can be modified : For example, for a given user '<USER>' : # chcon -R -t auth_home_t ~<USER>/.config/Yubico Created selinux-policy tracking bugs for this issue: Affects: fedora-all [bug 1871219] This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products. Acknowledgments: Name: Dietmar Lippold External References: https://bugzilla.redhat.com/show_bug.cgi?id=1860888 Upstream fix: * Add file context for ~/.config/Yubico https://github.com/fedora-selinux/selinux-policy/commit/71e1989028802c7875d3436fd3966c587fa383fb Statement: Red Hat Enterprise Linux is not affected by this issue as it does not ship pam-u2f. In Fedora, updating the package does not trigger a relabeling of the users' pre-existing 2nd factor configuration (including root), and such may need to be manually updated, using the `fixfiles onboot` command, followed by a reboot (or by applying the mitigation). |