Bug 2129904 (CVE-2022-3287)

Summary:	CVE-2022-3287 fwupd: world readable password in /etc/fwupd/redfish.conf
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhughes, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	fwupd 1.8.5	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in fwupd. When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-09 16:36:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2128810, 2129280, 2170950
Bug Blocks:	2129378

Description Mauro Matteo Cascella 2022-09-26 15:15:17 UTC

When the redfish plugin automatically creates an OPERATOR user account on the BMC we save the autogenerated password to /etc/fwupd/redfish.conf, ensuring it is chmod'ed to 0660 before writing the file with g_key_file_save_to_file(). The GLib in RHEL 9 versions instead calls g_file_set_contents_full() with the mode hardcoded to 0666, which undoes the previous chmod().

Comment 2 Mauro Matteo Cascella 2022-09-28 12:42:38 UTC

Upstream fix:
https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091

Comment 5 errata-xmlrpc 2023-05-09 07:52:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2487 https://access.redhat.com/errata/RHSA-2023:2487

Comment 6 Product Security DevOps Team 2023-05-09 16:36:08 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-3287

Comment 7 errata-xmlrpc 2023-11-14 15:22:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7189 https://access.redhat.com/errata/RHSA-2023:7189

Comment 9 errata-xmlrpc 2024-03-05 16:22:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:1106 https://access.redhat.com/errata/RHSA-2024:1106

Comment 10 errata-xmlrpc 2024-03-19 17:26:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:1403 https://access.redhat.com/errata/RHSA-2024:1403