Bug 859060 (CVE-2013-4392)
Summary: | CVE-2013-4392 systemd: TOCTOU race condition when updating file permissions and SELinux security contexts | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED UPSTREAM | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | carnil, fweimer, jlieskov, jrusnack, jsegitz, lnykryn, lpoetter, meissner, security-response-team, systemd-maint-list, systemd-maint, xaionaro, zbyszek |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2015-11-03 04:57:01 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 858760, 858766, 1043749 | ||
Bug Blocks: | 859151 |
Description
Jan Lieskovsky
2012-09-20 13:35:54 UTC
This issue affects the versions of the systemd package, as shipped with Fedora release of 16 and 17. Acknowledgements: This issue was discovered by Florian Weimer of the Red Hat Product Security Team. This was assigned CVE-2013-4392: http://www.openwall.com/lists/oss-security/2013/10/01/9 Do you know at which place this happened? I have a hard time pinpointing it down. ;) This is currently blocked by the need for new system calls (or making existing system calls work with O_PATH): http://article.gmane.org/gmane.linux.file-systems/82821 We need to open files to check their hard link count and make sure that is not greater than 1, so that we do not improperly relabel a file that is visible elsewhere in the file system. Without O_PATH, the open operation can have side effects, so we would introduce another type of security bug. Addressing this would also fix the other issue (lsetfilecon is called with absolute paths, which does not prevent symbol link resolution on non-final path components), but this issue could be fixed separate if desired. This issue affects the version of systemd as shipped with Fedora 19 and Fedora 20 and is waiting on upstream fix as indicated by comment #11. |