Bugzilla – Bug 947731
VUL-0: CVE-2015-1338: apport: kernel_crashdump accesses files in insecure manner
Last modified: 2018-02-09 06:14:13 UTC
CVE-2015-1338 it was discovered that Apport incorrectly handled kernel crash dump files. A local attacker could use this issue to cause a denial of service, or possibly elevate privileges. The default symlink protections for affected releases should reduce the vulnerability to a denial of service. References: http://www.ubuntu.com/usn/usn-2744-1/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1338
bugbot adjusting priority
Upstream bug: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1492570 Reproduction and research: http://www.halfdog.net/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities/ Commits: http://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3007 http://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3008 http://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3008?remember=3006&compare_revid=3006 We have this package in SLE 11 in a very old version. The insecure use of file open is in that code. The patch above needs serious re-work. Assign to SLE 11 maintainer. Requesting update as this is a local privilege escalation (is hardlink / symlink protection available on SLE 11?)
Jan, your submission is still missing...
nela asked me in IRC to analyze the PoCs for this issue, because they're pretty complex. It turns out that the whole exploit is based on /var/crash being world writable. While this seemed to be the case on Ubuntu back then, it is not the case in our SLE-11 distributions. This is makes no sense to further investigate the PoCs. This bugfix can be viewed as a kind of hardening but the issue doesn't affect us. The reproducers can thus be skipped.
SUSE-SU-2017:1938-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 947731 CVE References: CVE-2015-1338 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): apport-0.114-12.8.3.1, apport-crashdb-sle-0.114-0.8.3.1
Well the requested stuff was released...
released