Bug 2135420 (CVE-2022-3560) - CVE-2022-3560 pesign: Local privilege escalation on pesign systemd service
Summary: CVE-2022-3560 pesign: Local privilege escalation on pesign systemd service
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-3560
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2135819 2135820 2135821 2135822 2135823 2135824 2135825 2135826 2135827 2135828 2164235 2164236 2165983
Blocks: 2134226
TreeView+ depends on / blocked
 
Reported: 2022-10-17 15:26 UTC by Marco Benatto
Modified: 2023-07-12 08:31 UTC (History)
5 users (show)

Fixed In Version: pesign-116
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.
Clone Of:
Environment:
Last Closed: 2023-04-18 22:05:02 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:1065 0 None None None 2023-03-06 10:01:02 UTC
Red Hat Product Errata RHSA-2023:1066 0 None None None 2023-03-06 10:17:09 UTC
Red Hat Product Errata RHSA-2023:1067 0 None None None 2023-03-06 10:43:06 UTC
Red Hat Product Errata RHSA-2023:1093 0 None None None 2023-03-07 09:54:19 UTC
Red Hat Product Errata RHSA-2023:1107 0 None None None 2023-03-07 13:16:08 UTC
Red Hat Product Errata RHSA-2023:1572 0 None None None 2023-04-04 09:45:46 UTC
Red Hat Product Errata RHSA-2023:1586 0 None None None 2023-04-04 09:07:20 UTC
Red Hat Product Errata RHSA-2023:1829 0 None None None 2023-04-18 16:33:03 UTC

Description Marco Benatto 2022-10-17 15:26:49 UTC 
The pesign deamon started by the systemd service of the pesign package in vulnerable to a path traversal vulnerability allow a local privilege escalation. When properly exploited this flaw allows a malicious unprivileged user with access to pesign user or group can gain access to higher privileged files and directories.
Comment 17 Marco Benatto 2023-01-31 16:00:11 UTC 
Created pesign tracking bugs for this issue:

Affects: fedora-all [bug 2165983]
Comment 19 errata-xmlrpc 2023-03-06 10:01:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1065 https://access.redhat.com/errata/RHSA-2023:1065
Comment 20 errata-xmlrpc 2023-03-06 10:17:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1066 https://access.redhat.com/errata/RHSA-2023:1066
Comment 21 errata-xmlrpc 2023-03-06 10:43:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:1067 https://access.redhat.com/errata/RHSA-2023:1067
Comment 22 errata-xmlrpc 2023-03-07 09:54:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:1093 https://access.redhat.com/errata/RHSA-2023:1093
Comment 23 errata-xmlrpc 2023-03-07 13:16:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:1107 https://access.redhat.com/errata/RHSA-2023:1107
Comment 24 errata-xmlrpc 2023-04-04 09:07:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:1586 https://access.redhat.com/errata/RHSA-2023:1586
Comment 25 errata-xmlrpc 2023-04-04 09:45:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1572 https://access.redhat.com/errata/RHSA-2023:1572
Comment 26 errata-xmlrpc 2023-04-18 16:33:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:1829 https://access.redhat.com/errata/RHSA-2023:1829
Comment 27 Product Security DevOps Team 2023-04-18 22:04:59 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-3560
Note You need to log in before you can comment on or make changes to this bug.