[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAFqpC6zUc9DYKnBv3OBAsjOE9bgfGVqvoCW3B3f=CY43WfDVQA@mail.gmail.com>
Date: Thu, 1 Sep 2022 19:30:58 +0530
From: Tej Rathi <trathi@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Ondrej Mular <omular@...hat.com>
Subject: ClusterLabs/PCS: [CVE-2022-2735] Obtaining an authentication token
for hacluster user leads to privilege escalation.
Hello,
A security issue was discovered in the ClusterLabs/PCS project. This is
CVE-2022-2735, assigned by Red Hat.
(https://github.com/ClusterLabs/pcs)
*ROOT CAUSE & IMPACT:*
*------------------------------------*
It is caused by incorrect permissions on a unix socket used for internal
communication between pcs daemons. Reproducer below demonstrates a
privilege escalation by obtaining authentication token for hacluster
user. With the hacluster token, an attacker has complete control over
the cluster managed by pcs.
CVSS Base Score [HIGH]: 8.4/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
*AFFECTED VERSIONS:*
*---------------------------------*
pcs upstream is affected since version 0.10.5 [1][2]. This means that all
0.10.x versions starting from 0.10.5 including the latest 0.10 branch
release 0.10.14 are affected. And all 0.11.x versions are affected as well.
POC and PATCH are in the attachment.
*CREDITS:*
*--------------*
The issue was discovered by Ondrej Mular (Senior Software Engineer, Red Hat)
*REFERENCES:*
*---------------------*
[1]: https://github.com/ClusterLabs/pcs/releases/tag/0.10.5
[2]:
https://github.com/ClusterLabs/pcs/blob/main/CHANGELOG.md#0105---2020-03-18
- - - - - - - - - - - - - - - -
Thanks & Regards,
TEJ RATHI
Associate Product Security Engineer | PSIRT
Product Security Engineering, Red Hat.
Content of type "text/html" skipped
Download attachment "patch" of type "application/octet-stream" (1186 bytes)
Download attachment "poc" of type "application/octet-stream" (2187 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
