Bug 1908577 (CVE-2020-35501)

Summary:	CVE-2020-35501 kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability
Product:	[Other] Security Response	Reporter:	Wade Mealing <wmealing>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bhu, blc, bmasney, chwhite, dvlasenk, felix.kosterhon, hdegoede, hkrzesin, jarodwilson, jeremy, jforbes, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mlangsdo, nmurray, ptalbert, qzhao, rbriggs, rkeshri, rvrbovsk, sgrubb, steved, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem	Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-07-18 16:26:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1933649, 1933650, 1933651, 1935474, 1935475, 1935476, 1935477, 1935478, 1936258, 1938167
Bug Blocks:	1899669, 1937220

Description Wade Mealing 2020-12-17 04:43:33 UTC

A flaw was found in the kernel's audit by access permission feature which would not record open_by_handle_at syscalls.

This does not mean that a user is granted access to resources that they would not be able to.  This means that the audit log trail would not contain the log events of access.

Comment 2 Rohit Keshri 2020-12-21 10:07:38 UTC

Acknowledgments:

Name: Felix Kosterhon (SECUINFRA GmbH)

Comment 15 Richard Guy Briggs 2021-03-05 15:21:32 UTC

This is public:
2021-02-18 https://seclists.org/oss-sec/2021/q1/155
2021-03-02 https://listman.redhat.com/archives/linux-audit/2021-February/msg00079.html
related 2016-04-16 https://github.com/linux-audit/audit-kernel/issues/9

Comment 16 Wade Mealing 2021-03-08 00:41:51 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1936258]

Comment 19 Wade Mealing 2021-03-10 05:35:24 UTC

Mitigation:

This syscall can still be audited by using the 'syscall auditing feature' by passing open_by_handle_at to it in the rule.  Existing auditing ruleset requirements generally use this mechanism.