Bug 1908577 (CVE-2020-35501)

Summary: CVE-2020-35501 kernel: audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability
Product: [Other] Security Response Reporter: Wade Mealing <wmealing>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: acaringi, adscvr, airlied, alciregi, bhu, blc, bmasney, chwhite, dvlasenk, felix.kosterhon, hdegoede, hkrzesin, jarodwilson, jeremy, jforbes, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mlangsdo, nmurray, ptalbert, qzhao, rbriggs, rkeshri, rvrbovsk, sgrubb, steved, walters, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1933649, 1933650, 1933651, 1935474, 1935475, 1935476, 1935477, 1935478, 1936258, 1938167    
Bug Blocks: 1899669, 1937220    

Description Wade Mealing 2020-12-17 04:43:33 UTC
A flaw was found in the kernel's audit by access permission feature which would not record open_by_handle_at syscalls.

This does not mean that a user is granted access to resources that they would not be able to.  This means that the audit log trail would not contain the log events of access.

Comment 2 Rohit Keshri 2020-12-21 10:07:38 UTC
Acknowledgments:

Name: Felix Kosterhon (SECUINFRA GmbH)

Comment 16 Wade Mealing 2021-03-08 00:41:51 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1936258]

Comment 19 Wade Mealing 2021-03-10 05:35:24 UTC
Mitigation:

This syscall can still be audited by using the 'syscall auditing feature' by passing open_by_handle_at to it in the rule.  Existing auditing ruleset requirements generally use this mechanism.