Bug 859060 - (CVE-2013-4392) CVE-2013-4392 systemd: TOCTOU race condition when updating file permissions and SELinux security contexts
CVE-2013-4392 systemd: TOCTOU race condition when updating file permissions a...
Status: CLOSED UPSTREAM
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20130923,repor...
: Security
Depends On: 858766 858760 1043749
Blocks: 859151
  Show dependency treegraph
 
Reported: 2012-09-20 09:35 EDT by Jan Lieskovsky
Modified: 2015-11-05 04:10 EST (History)
13 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-02 23:57:01 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-09-20 09:35:54 EDT
A TOCTOU (time-of-check time-of-use) race condition was found in the way systemd, a system and service manager, used to update file permissions and SELinux security contexts. A local attacker could use this flaw to conduct symbolic link attacks possibly leading to their ability to modify permissions / security context of a path different than originally intended / requested.

Issue found by Florian Weimer, Red Hat Product Security Team
Comment 1 Jan Lieskovsky 2012-09-20 09:37:33 EDT
This issue affects the versions of the systemd package, as shipped with Fedora release of 16 and 17.
Comment 3 Vincent Danen 2013-10-01 18:52:13 EDT
Acknowledgements:

This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
Comment 4 Vincent Danen 2013-10-01 18:52:54 EDT
This was assigned CVE-2013-4392:

http://www.openwall.com/lists/oss-security/2013/10/01/9
Comment 5 Marcus Meissner 2013-11-22 06:00:34 EST
Do you know at which place this happened? I have a hard time pinpointing it down. ;)
Comment 11 Florian Weimer 2014-03-24 05:05:50 EDT
This is currently blocked by the need for new system calls (or making existing system calls work with O_PATH):

http://article.gmane.org/gmane.linux.file-systems/82821

We need to open files to check their hard link count and make sure that is not greater than 1, so that we do not improperly relabel a file that is visible elsewhere in the file system.  Without O_PATH, the open operation can have side effects, so we would introduce another type of security bug.

Addressing this would also fix the other issue (lsetfilecon is called with absolute paths, which does not prevent symbol link resolution on non-final path components), but this issue could be fixed separate if desired.
Comment 12 Huzaifa S. Sidhpurwala 2014-03-24 05:35:02 EDT
This issue affects the version of systemd as shipped with Fedora 19 and Fedora 20 and is waiting on upstream fix as indicated by comment #11.

Note You need to log in before you can comment on or make changes to this bug.