Bug 1633243 – CVE-2018-14650 sos-collector: incorrect permissions set on newly created files

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1633243 - (CVE-2018-14650) CVE-2018-14650 sos-collector: incorrect permissions set on newly created files

Summary:	CVE-2018-14650 sos-collector: incorrect permissions set on newly created files

Status:	NEW

Aliases:	CVE-2018-14650

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20180927,repor...
Keywords:	Security

Depends On:	1633666 1633659
Blocks:	1610988 1633248
	Show dependency tree / graph

Reported:	2018-09-26 09:47 EDT by Riccardo Schirone
Modified:	2018-09-27 09:49 EDT (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	---
Doc Text:	It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Riccardo Schirone 2018-09-26 09:47:24 EDT

sos-collector does not set any permission when creating new files, thus the default umask is used, making all newly created files readable by all local users. Given the delicacy of the data collected by sos-collector, all files created by the tool, including the sos-reports collected from the cluster machines, should be accessible only the to current user. A local attacker can use this flaw to read sensitive information collected from other machines when a legit user runs sos-collector.

Upstream patch:
https://github.com/sosreport/sos-collector/commit/72058f9253e7ed8c7243e2ff76a16d97b03d65ed

Comment 3 Riccardo Schirone 2018-09-26 10:47:28 EDT

Acknowledgments:

Name: Riccardo Schirone (Red Hat Product Security)

Comment 4 Riccardo Schirone 2018-09-27 09:31:46 EDT

Created sos-collector tracking bugs for this issue:

Affects: fedora-all [bug 1633659]

Note You need to log in before you can comment on or make changes to this bug.