Bug 1694875
| Summary: | Chance for abuse of sudo using "scl" command | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Software Collections | Reporter: | tepi | ||||
| Component: | scl-utils | Assignee: | Joe Orton <jorton> | ||||
| Status: | CLOSED WONTFIX | QA Contact: | BaseOS QE - Apps <qe-baseos-apps> | ||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | unspecified | CC: | jorton, kanderso, tepi | ||||
| Target Milestone: | --- | ||||||
| Target Release: | 3.7 | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2021-03-15 07:34:50 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. |
Created attachment 1550780 [details] Diff file to show what i added to patch the aforementioned bug Description of problem: I recently found an issue with the current version of scl-utils which enables privilege escalation, namely the "scl" command. If a user runs "sudo scl enable rh-ruby25 bash" for instance it drops into a root shell which is pretty bad/good depending on which side of the fence you're on lol. So I was able to integrate a patch on my host that fixes the problem and doesn't spawn a new root shell. The problem came when parsing arguments in the 'args.c' file mainly lines 331-359. Version-Release number of selected component (if applicable): 20130529.19.el7 How reproducible: Easily reproducible Steps to Reproduce: 1. sudo scl enable rh-ruby25 bash 2. whoami;id Actual results: A persistent shell as root. Expected results: Return to shell of user who called sudo, or to fail on double sudo. Additional info: I have already written a patch for it that drops privileges back down to the sudoer stopping the attacker from gaining access to the root user.