Bug 1975142 (CVE-2021-3621) - CVE-2021-3621 sssd: shell command injection in sssctl
Summary: CVE-2021-3621 sssd: shell command injection in sssctl
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3621
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1973411 1975169 1985454 1985455 1985456 1985457 1985877 1985878 1989830 1993799 1993910 2048284
Blocks: 1975138 1975969
TreeView+ depends on / blocked
 
Reported: 2021-06-23 07:58 UTC by Cedric Buissart
Modified: 2023-01-31 09:32 UTC (History)
25 users (show)

Fixed In Version: sssd 2.6.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-08-16 13:28:15 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3151 0 None None None 2021-08-16 08:44:28 UTC
Red Hat Product Errata RHSA-2021:3178 0 None None None 2021-08-17 08:30:49 UTC
Red Hat Product Errata RHSA-2021:3235 0 None None None 2021-08-19 15:48:45 UTC
Red Hat Product Errata RHSA-2021:3336 0 None None None 2021-08-31 09:11:16 UTC
Red Hat Product Errata RHSA-2021:3365 0 None None None 2021-08-31 09:22:13 UTC
Red Hat Product Errata RHSA-2021:3477 0 None None None 2021-09-09 09:22:14 UTC

Description Cedric Buissart 2021-06-23 07:58:30 UTC 
`sssctl_run_command()` is a wrapper for running commands via a shell, using glibc's `system()` function call.
`sssctl_cache_expire()` and `sssctl_logs_fetch()` allow user provided arguments, and pass them to `sssctl_run_command()`
sssctl is limited to root user, however, if an administrator allows unprivileged users to provide arguments to the command (e.g.: via sudo), this could be used to elevate privileges via a shell injection.

Although there are no known default configuration where this flaw could be exploited, the admin could have manually created sudo rules to let regular users use sssctl commands, or could be tricked into running a specially crafted sssctl command.

References:

https://sssd.io/release-notes/sssd-2.6.0.html
Comment 20 errata-xmlrpc 2021-08-16 08:44:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3151 https://access.redhat.com/errata/RHSA-2021:3151
Comment 21 Cedric Buissart 2021-08-16 11:54:02 UTC 
Created sssd tracking bugs for this issue:

Affects: fedora-all [bug 1993910]
Comment 22 Product Security DevOps Team 2021-08-16 13:28:15 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3621
Comment 23 errata-xmlrpc 2021-08-17 08:30:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:3178 https://access.redhat.com/errata/RHSA-2021:3178
Comment 24 errata-xmlrpc 2021-08-19 15:48:43 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2021:3235 https://access.redhat.com/errata/RHSA-2021:3235
Comment 25 Cedric Buissart 2021-08-23 15:33:06 UTC 
Upstream fix :
https://github.com/SSSD/sssd/commit/7ab83f97e1cbefb78ece17232185bdd2985f0bbe
Comment 26 errata-xmlrpc 2021-08-31 09:11:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:3336 https://access.redhat.com/errata/RHSA-2021:3336
Comment 27 errata-xmlrpc 2021-08-31 09:22:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3365 https://access.redhat.com/errata/RHSA-2021:3365
Comment 28 errata-xmlrpc 2021-09-09 09:22:12 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2021:3477 https://access.redhat.com/errata/RHSA-2021:3477
Note You need to log in before you can comment on or make changes to this bug.