Bug 1133506 - (CVE-2019-3843) VUL-0: CVE-2019-3843: systemd: services with DynamicUser can create SUID/SGID binaries
(CVE-2019-3843)
VUL-0: CVE-2019-3843: systemd: services with DynamicUser can create SUID/SGID...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/230356/
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-04-26 09:01 UTC by Marcus Meissner
Modified: 2019-11-30 15:43 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2019-04-26 09:01:33 UTC
rh#1684607

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1684607
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-3843
Comment 2 Marcus Meissner 2019-04-26 09:32:52 UTC
dynamic user support seems to be in since v232 , did we backport it?
Comment 3 Franck Bui 2019-05-03 08:32:28 UTC
Nope, therefore only SLE15 should be affected (I've not looked at the details yet)
Comment 4 Franck Bui 2019-05-03 10:17:35 UTC
Marcus, if I read the bug description correctly, it's not really a bug per se but some extra hardening measures (which rely on seccomp) introduced to make sure that services using DynamicUser=1 can't create nor execute SUID/SGID binaries.

At least none of the services shipped by systemd uses DynamicUser=1.
Comment 5 Franck Bui 2019-05-03 10:19:33 UTC
Did you find a reproducer in off chance ?
Comment 6 Franck Bui 2019-05-03 13:51:25 UTC
(In reply to Marcus Meissner from comment #1)
> https://github.com/systemd/systemd/commit/
> bf65b7e0c9fc215897b676ab9a7c9d1c688143ba

Marcus this commit is a compatibility break and Customer's services using DynamicUser=1 will break if they play tricks with SUID/SGID files.

I don't think this will be the case in practice but who knows...
Comment 7 Marcus Meissner 2019-05-07 15:36:24 UTC
https://bugs.chromium.org/p/project-zero/issues/detail?id=1771  has a reproducer

I would say the customers should not play tricks with this ;)
Comment 8 Franck Bui 2019-05-10 07:56:36 UTC
Agreed.

I submitted new MR#192322 which should fix both this bug and bsc#1133509.

Re-assigning to the secteam.
Comment 10 Swamp Workflow Management 2019-05-28 13:15:40 UTC
SUSE-SU-2019:1364-1: An update that solves four vulnerabilities and has 9 fixes is now available.

Category: security (moderate)
Bug References: 1036463,1121563,1124122,1125352,1125604,1126056,1127557,1130230,1132348,1132400,1132721,1133506,1133509
CVE References: CVE-2019-3842,CVE-2019-3843,CVE-2019-3844,CVE-2019-6454
Sources used:
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    systemd-234-24.30.1, systemd-mini-234-24.30.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    systemd-234-24.30.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2019-07-15 20:13:49 UTC
SUSE-SU-2019:1364-2: An update that solves four vulnerabilities and has 9 fixes is now available.

Category: security (moderate)
Bug References: 1036463,1121563,1124122,1125352,1125604,1126056,1127557,1130230,1132348,1132400,1132721,1133506,1133509
CVE References: CVE-2019-3842,CVE-2019-3843,CVE-2019-3844,CVE-2019-6454
Sources used:
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    systemd-234-24.30.1, systemd-mini-234-24.30.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    systemd-234-24.30.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Marcus Meissner 2019-11-02 19:03:05 UTC
released