Bug 1332508 (CVE-2016-10151) - CVE-2016-10151 hesiod: Weak SUID check allowing privilege elevation
Summary: CVE-2016-10151 hesiod: Weak SUID check allowing privilege elevation
Status: CLOSED WONTFIX
Alias: CVE-2016-10151
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: https://github.com/achernya/hesiod/pu...
Whiteboard: impact=low,public=20160503,reported=2...
Keywords: Security
Depends On: 1332509
Blocks: 1332511
TreeView+ depends on / blocked
 
Reported: 2016-05-03 11:08 UTC by Adam Mariš
Modified: 2017-01-23 01:17 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-01-23 01:17:09 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
proposed fix (1.69 KB, patch)
2016-05-03 17:15 UTC, Nalin Dahyabhai
no flags Details | Diff

Description Adam Mariš 2016-05-03 11:08:16 UTC
It was reported that hesiod unsafely checks EUID against UID in a few places to protect overriding certain configuration values with environment variables.

Vulnerable code:

configname = ((getuid() == geteuid()) && (getgid() == getegid()))
? getenv("HESIOD_CONFIG") : NULL;

If the process has elected to become full root, or dropped privileges while still possessing the file descriptor with additional privileges, or by some other way satisfies EUID == UID check without dropping all privileges, it can might allow privilege escalation for local attackers who are able to set the HESIOD_CONFIG or HES_DOMAIN environment variables and run affected SUID/SGUID binary.

Comment 1 Adam Mariš 2016-05-03 11:08:25 UTC
Acknowledgments:

Name: Florian Weimer (Red Hat)

Comment 2 Adam Mariš 2016-05-03 11:08:39 UTC
Created hesiod tracking bugs for this issue:

Affects: fedora-all [bug 1332509]

Comment 3 Florian Weimer 2016-05-03 11:28:42 UTC
glibc is not affected because it uses secure_getenv.

Comment 4 Nalin Dahyabhai 2016-05-03 17:15 UTC
Created attachment 1153516 [details]
proposed fix

Comment 5 Doran Moppert 2017-01-18 02:33:38 UTC
Statement:

Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.