A vulnerability in sosreport was reported, allowing a privilege escalation to unprivileged attacker on RHEL-6, and change the owner and content of certain files on RHEL-7. sosreport creates temporary directory in /tmp with predictable name sosreport-$hostname-$date with permissions set to 700. Then it creates a tar file with the aforementioned name + .tar suffix. Further it invokes open() with no O_NOFOLLOW nor O_EXCL set, which can be exploited by placing a file or a symlink in its place. Attacker can create his own file to steal the content or can create a symlink to create/modify arbitrary files. On RHEL-7, there is fs.protected_symlinks sysctl provided, which closes this vector. With the setting target of the symlink must match symlink's owner. On RHEL-6 this feature is missing, so the attacker is able to modify arbitrary files and escalate privileges.
> sosreport creates temporary directory in /tmp with predictable name > sosreport-$hostname-$date" The name of the directory is not predictable - it's the fact that we then re-use that (now published in the file system) name for the final tar archive that allows a malicious user to predict the archive path name. I expect to push a fix for this upstream in the next couple of days however due to product integration needs we may need to use a slightly different approach in any urgent erratas.
Created attachment 1097279 [details] [policies] move hash determination to policies
Created attachment 1097280 [details] [policies] refactor Policy.display_results() args
Created attachment 1097281 [details] [sosreport] move archive checksumming to sosreport
Created attachment 1097283 [details] [sosreport] prepare report in a private subdirectory
Created sos tracking bugs for this issue: Affects: fedora-all [bug 1286934]
sos-3.2-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2016:0152 https://rhn.redhat.com/errata/RHSA-2016-0152.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:0188 https://rhn.redhat.com/errata/RHSA-2016-0188.html