Bug 1457832 – CVE-2017-6512 perl-File-Path: rmtree/remove_tree race condition

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1457832 - (CVE-2017-6512) CVE-2017-6512 perl-File-Path: rmtree/remove_tree race condition

Summary:	CVE-2017-6512 perl-File-Path: rmtree/remove_tree race condition

Status:	CLOSED WONTFIX

Aliases:	CVE-2017-6512

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20170502,reported=2...
Keywords:	Security

Depends On:	1457834
Blocks:	1457837
	Show dependency tree / graph

Reported:	2017-06-01 07:58 EDT by Andrej Nemec
Modified:	2017-06-30 08:28 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:	perl-File-Path 2.13
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-06-30 08:28:30 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Andrej Nemec 2017-06-01 07:58:26 EDT

A vulnerability was found in perl File-Path. In the rmtree() and remove_tree() functions, the chmod()logic to make directories traversable can be abused to set the mode on an attacker-chosen file to an attacker-chosen value.  This is due to the time-of-check-to-time-of-use (TOCTTOU) race condition between the stat() that decides the inode is a directory and the chmod() that tries to make it user-rwx.

Upstream issue:

https://rt.cpan.org/Public/Bug/Display.html?id=121951

Upstream patch:

https://github.com/jkeenan/File-Path/commit/e5ef95276ee8ad471c66ee574a5d42552b3a6af2

Comment 1 Andrej Nemec 2017-06-01 07:59:31 EDT

Created perl-File-Path tracking bugs for this issue:

Affects: fedora-all [bug 1457834]

Comment 2 Stefan Cornelius 2017-06-30 08:28:42 EDT

Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.