Bug 1945886

Summary:	CVE-2021-3429 cloud-init: log passwords to world-readable file [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Riccardo Schirone <rschiron>
Component:	cloud-init	Assignee:	Dusty Mabe <dustymabe>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	33	CC:	adimania, apevec, dustymabe, eterrell, gholms, lars, mhayden, shardy, s
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-09-08 11:14:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1940967

Description Riccardo Schirone 2021-04-02 13:11:27 UTC

This is an automatically created tracking bug!  It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.

For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.

For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs

When submitting as an update, use the fedpkg template provided in the next
comment(s).  This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.

Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.

NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time.  If you need to fix the versions independent of each other,
you may clone this bug as appropriate.

Comment 1 Riccardo Schirone 2021-04-02 13:11:30 UTC

Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug.  This will ensure that all associated bugs get updated
when new packages are pushed to stable.

=====

# bugfix, security, enhancement, newpackage (required)
type=security

# low, medium, high, urgent (required)
severity=medium

# testing, stable
request=testing

# Bug numbers: 1234,9876
bugs=1940967,1945886

# Description of your update
notes=Security fix for [PUT CVEs HERE]

# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3

# Automatically close bugs when this marked as stable
close_bugs=True

# Suggest that users restart after update
suggest_reboot=False

======

Additionally, you may opt to use the bodhi web interface to submit updates:

https://bodhi.fedoraproject.org/updates/new

Comment 2 Eduardo Otubo 2021-09-08 11:14:25 UTC

The fix for this CVE is present on our latest rebase (21.3) for Fedora Rawhide.

commit b794d426b9ab43ea9d6371477466070d86e10668
Author: Daniel Watkins <oddbloke>
Date:   Fri Mar 19 10:06:42 2021 -0400

    write passwords only to serial console, lock down cloud-init-output.log (#847)
    
    Prior to this commit, when a user specified configuration which would
    generate random passwords for users, cloud-init would cause those
    passwords to be written to the serial console by emitting them on
    stderr.  In the default configuration, any stdout or stderr emitted by
    cloud-init is also written to `/var/log/cloud-init-output.log`.  This
    file is world-readable, meaning that those randomly-generated passwords
    were available to be read by any user with access to the system.  This
    presents an obvious security issue.
    
    This commit responds to this issue in two ways:
    
    * We address the direct issue by moving from writing the passwords to
      sys.stderr to writing them directly to /dev/console (via
      util.multi_log); this means that the passwords will never end up in
      cloud-init-output.log
    * To avoid future issues like this, we also modify the logging code so
      that any files created in a log sink subprocess will only be
      owner/group readable and, if it exists, will be owned by the adm
      group.  This results in `/var/log/cloud-init-output.log` no longer
      being world-readable, meaning that if there are other parts of the
      codebase that are emitting sensitive data intended for the serial
      console, that data is no longer available to all users of the system.
    
    LP: #1918303