A local non-root user with access to the D-Bus system bus can call the CheckConfig method implemented in the tcmu-runner daemon via handler_qcow.so and exploit an information leak by passing in arbitrary filenames to check. This allows a local user to check for the existence of root owned files, which might enable more serious security issues in combination with other security flaws in a system. Upstream patch: https://github.com/open-iscsi/tcmu-runner/commit/8cf8208775022301adaa59c240bb7f93742d1329 References: http://seclists.org/oss-sec/2017/q3/207
Created tcmu-runner tracking bugs for this issue: Affects: fedora-all [bug 1487255]
This issue has been addressed in the following products: Red Hat Gluster Storage 3.3 for RHEL 7 Via RHSA-2017:3277 https://access.redhat.com/errata/RHSA-2017:3277