Bug 894626
| Summary: | haproxy: Fails to properly drop supplementary groups after setuid / setgid calls | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Michael S. <misc> | ||||||||
| Component: | haproxy | Assignee: | Ryan O'Hara <rohara> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||
| Severity: | unspecified | Docs Contact: | |||||||||
| Priority: | unspecified | ||||||||||
| Version: | 18 | CC: | jlieskov, rohara, security-response-team, sgrubb | ||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2013-04-26 23:59:29 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
Michael S.
2013-01-12 18:37:54 UTC
I also just checked that using haproxy with systemd totally mask the issue, since systemd clear the group membership before starting anything. Finally, upstream wrote a 3rd patch, who should take care of a corner case ( ie someone using setgid when run as simple user, or something like that ) and is simpler than mine ( ie, directly drop all groups. I rediffed against latest git as he sent it to me by mail, so formatting or details may differ. Also, discussing wit Kurt by email, we were a little bit too optimistic to qualify that as a security vulnerability, while this is just a failure to harden the process. I do not know if that change much to the process on your side. Regarding the patch, I'd consider calling exit(1) if setgroups failed. Not doing that leads to CWE-250: Execution with Unnecessary Privileges. Meaning that should another vulnerability be found that is exploitable and the app is running with too much privileges, the attacker could then start to write to files that are group writable and possibly become a persistent compromise. Created attachment 678262 [details]
2nd proposal
That's the 2nd proposal upstream suggested ( modulo formatting ).
I think may we should invite him to discuss here instead of having me doing the middle man :)
( email w, not sure if he has a bugzilla account )
Created attachment 680418 [details]
Propoxed upstream patch
Relevant upstream patch: [1] http://git.1wt.eu/web?p=haproxy.git;a=commitdiff;h=ab012dd3 What happened with the upstream patch? I checked the upstream git repo and it appears the fix was only merged into development branch. (In reply to comment #10) > What happened with the upstream patch? I checked the upstream git repo and > it appears the fix was only merged into development branch. Hi Ryan, do you need that patch backported against some concrete versions? If so, let me know and I will check with upstream to get it. Ad what happened with upstream patch - assuming since this wasn't considered as a security flaw, it hasn't been backported into older releases. Jan. (In reply to comment #11) > (In reply to comment #10) > > What happened with the upstream patch? I checked the upstream git repo and > > it appears the fix was only merged into development branch. > > Hi Ryan, > > do you need that patch backported against some concrete versions? If so, > let me know and I will check with upstream to get it. Ad what happened with > upstream patch - assuming since this wasn't considered as a security flaw, > it hasn't been backported into older releases. > > Jan. Backporting this is simple. I was just under the assumption that this was fixed in the stable release. When possible, I prefer not to diverge from upstream. I've talked with upstream developers and I expect this will be fixed in stable branch and released as 1.4.23. Stay tuned. haproxy-1.4.23-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/haproxy-1.4.23-1.fc19 haproxy-1.4.23-1.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/haproxy-1.4.23-1.fc18 Package haproxy-1.4.23-1.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing haproxy-1.4.23-1.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-4783/haproxy-1.4.23-1.fc19 then log in and leave karma (feedback). haproxy-1.4.23-2.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/haproxy-1.4.23-2.fc19 haproxy-1.4.23-1.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report. haproxy-1.4.23-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. |