It was reported that hesiod unsafely checks EUID against UID in a few places to protect overriding certain configuration values with environment variables. Vulnerable code: configname = ((getuid() == geteuid()) && (getgid() == getegid())) ? getenv("HESIOD_CONFIG") : NULL; If the process has elected to become full root, or dropped privileges while still possessing the file descriptor with additional privileges, or by some other way satisfies EUID == UID check without dropping all privileges, it can might allow privilege escalation for local attackers who are able to set the HESIOD_CONFIG or HES_DOMAIN environment variables and run affected SUID/SGUID binary.
Acknowledgments: Name: Florian Weimer (Red Hat)
Created hesiod tracking bugs for this issue: Affects: fedora-all [bug 1332509]
glibc is not affected because it uses secure_getenv.
Created attachment 1153516 [details] proposed fix
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.