keepalived before version 2.0.9 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd. Upstream Patch: https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe2750306 Upstream Issue: https://github.com/acassen/keepalived/issues/1048 Reference: https://bugzilla.suse.com/show_bug.cgi?id=1015141
Created keepalived tracking bugs for this issue: Affects: fedora-all [bug 1651864]
Statement: This issue affects the versions of keepalived as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/. The keepalived packages shipped with Red Hat Enterprise Linux 6 and 7 are not built with dbus support, therefore vulnerable PrintData and PrintStats methods are not compiled in resulting RPM, which means this issue cannot be exploited via dbus messages on Red Hat Enterprise Linux 6 and 7. However, creation of pidfiles is also vulnerable to symlink attack and it is possible for local attacker to overwrite arbitrary file with the process identifiers of keepalived processes, but only if keepalived was launched with option to change pidfile location pointing to unsafe location and attacker is able to exploit Time-of-check Time-of-use race condition and create a symlink during a very small time frame in the same location the pidfile was specified. The default location used for pidfiles is safe. Red Hat Enterprise Linux 7 is by default configured with fs.protected_symlinks=1 which largely mitigates symlink attacks.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2285 https://access.redhat.com/errata/RHSA-2019:2285
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-19044