A flaw was found in libqb. Isecure handling of temporari files could be exploited by a local attacker to overwrite privileged system files. Upstream issue: https://github.com/ClusterLabs/libqb/issues/338 References: https://bugzilla.redhat.com/show_bug.cgi?id=1685297
Created libqb tracking bugs for this issue: Affects: fedora-all [bug 1695949]
v1.0.4 has been released upstream to fix these issues
Has a CVE been assigned for this flaw, yet? FTR. v1.0.4 could technically solve the problem, but we don't want to advertise that version anywhere, for being botched, rendering it's prime use case (cluster stack) unusable -- subsequent v1.0.5 fixes that: https://lists.clusterlabs.org/pipermail/users/2019-April/025712.html
Analysis: The problem basically lies in how temporary files are handled by the libqb. 1. Predictable file names are used in the world writeable directories namely /dev/shm and /tmp. 2. O_EXCL flag is not used when creating temp files. This could be exploited by a local attacker to overwrite privileged system files (if not restricted by sandboxing, MAC or symlinking policies). Most likely attack scenario is when a privileged program linked against libqb uses temp files. Due to the race-condition it is possible that the attacker could overwrite arbitrary system files. Patch: https://github.com/ClusterLabs/libqb/commit/e322e98dc264bc5911d6fe1d371e55ac9f95a71e https://github.com/ClusterLabs/libqb/commit/7cd7b06d52ac80c343f362c7e39ef75495439dfc
Re [comment 6]: as instructed, asked for a CVE from MITRE. Will report back here.
This has been assigned CVE-2019-12779.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:3610 https://access.redhat.com/errata/RHSA-2019:3610
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-12779
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:1189 https://access.redhat.com/errata/RHSA-2020:1189
*** Bug 1714855 has been marked as a duplicate of this bug. ***