Bug 856341 (CVE-2012-4417)

Summary: CVE-2012-4417 GlusterFS: insecure temporary file creation
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aavati, amarts, gluster-bugs, jlieskov, johnmark, jrusnack, kaushal, kkeithle, meyering, rhs-bugs, security-response-team, vbellur, vinaraya
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20121112,reported=20120827,source=redhat,cvss2=2.1/AV:L/AC:L/Au:N/C:N/I:P/A:N,rhes-2.0/glusterfs=affected,fedora-all/glusterfs=affected,epel-all/glusterfs=affected,cwe=CWE-377
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-12-12 01:36:50 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 856345, 856429, 856677, 875888, 875889    
Bug Blocks: 856353    

Description Kurt Seifried 2012-09-11 16:08:19 EDT
Jim Meyering (meyering@redhat.com) of Red Hat reports:

glusterfs writes to predictably-named files in /tmp using the PID and other 
non random or easily guessed information to create file names.

libglusterfs/src/statedump.c

gf_proc_dump_open (char *dump_dir, char *brickname)
{
        char path[PATH_MAX] = {0,};
        int  dump_fd = -1;

	snprintf (path, sizeof (path), "%s/%s.%d.dump", (dump_dir ?
                  dump_dir : "/tmp"), brickname, getpid());

...

gf_proc_dump_options_init ()
{
	int     ret = -1;
	FILE    *fp = NULL;
        char    buf[256];
        char    dumpbuf[GF_DUMP_MAX_BUF_LEN];
        char    *key = NULL, *value = NULL;
        char    *saveptr = NULL;
        char    dump_option_file[PATH_MAX];

	snprintf (dump_option_file, sizeof (dump_option_file),
                  "/tmp/glusterdump.%d.options", getpid ());
Comment 10 Murray McAllister 2012-10-14 18:31:47 EDT
Acknowledgements:

These issues were discovered by Kurt Seifried of Red Hat, and Jim Meyering.
Comment 14 Jan Lieskovsky 2012-11-12 13:36:57 EST
Created glusterfs tracking bugs for this issue

Affects: fedora-all [bug 875888]
Affects: epel-all [bug 875889]
Comment 15 errata-xmlrpc 2012-11-12 13:47:13 EST
This issue has been addressed in following products:

  Red Hat Storage 2.0
  Native Client for RHEL 6 for Red Hat Storage
  Native Client for RHEL 5 for Red Hat Storage

Via RHSA-2012:1456 https://rhn.redhat.com/errata/RHSA-2012-1456.html
Comment 16 JMW 2012-11-15 14:40:44 EST
Any word on an upstream fix?
Comment 17 Amar Tumballi 2012-11-15 22:29:09 EST
commit 3d10587d9d6400c9141b1f278bb5e2027fa784b8 (http://review.gluster.org/4042)
and
commit 56d1f81949fde78615cd9fec048259d261f99c40 (http://review.gluster.org/4091)

are done upstream to handle it.
Comment 18 JMW 2012-11-16 07:30:05 EST
(In reply to comment #17)
> commit 3d10587d9d6400c9141b1f278bb5e2027fa784b8
> (http://review.gluster.org/4042)
> and
> commit 56d1f81949fde78615cd9fec048259d261f99c40
> (http://review.gluster.org/4091)
> 
> are done upstream to handle it.

Thanks, Amar.
Comment 19 Kurt Seifried 2012-12-12 01:36:50 EST
This was partially addressed in http://rhn.redhat.com/errata/RHSA-2012-1456.html

Please see bug #886364 for additional information
Comment 20 JMW 2012-12-18 17:04:16 EST
(In reply to comment #17)
> commit 3d10587d9d6400c9141b1f278bb5e2027fa784b8
> (http://review.gluster.org/4042)
> and
> commit 56d1f81949fde78615cd9fec048259d261f99c40
> (http://review.gluster.org/4091)
> 
> are done upstream to handle it.

Amar - any chance of applying a patch to 3.2.x? This comes via this request:

https://security-tracker.debian.org/tracker/CVE-2012-4417