Bug 836931 (CVE-2013-4311) - VUL-1: CVE-2013-4311: libvirtd: polkit-process subject race condition
Summary: VUL-1: CVE-2013-4311: libvirtd: polkit-process subject race condition
Status: RESOLVED FIXED
Alias: CVE-2013-4311
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:SUSE:CVE-2013-4288:6.9:(AV:L/A...
Keywords:
Depends on: CVE-2013-4288 836932 CVE-2013-4326
Blocks:
  Show dependency treegraph
 
Reported: 2013-08-27 08:32 UTC by Sebastian Krahmer
Modified: 2021-04-23 14:12 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
0001-git-master-Also-store-user-group-ID-values-in-virIdentity.patch (5.23 KB, patch)
2013-09-10 11:21 UTC, Sebastian Krahmer
Details | Diff
0001-rhel6-Include-process-start-time-when-doing-polkit-checks.patch (20.66 KB, patch)
2013-09-10 11:22 UTC, Sebastian Krahmer
Details | Diff
0002-git-master-Ensure-system-identity-includes-process-start-time.patch (2.02 KB, patch)
2013-09-10 11:23 UTC, Sebastian Krahmer
Details | Diff
0002-rhel6-Add-support-for-using-3-arg-pkcheck-syntax-for-proce.patch (3.78 KB, patch)
2013-09-10 11:23 UTC, Sebastian Krahmer
Details | Diff
0003-git-master-Add-support-for-using-3-arg-pkcheck-syntax-for-proce.patch (5.99 KB, patch)
2013-09-10 11:24 UTC, Sebastian Krahmer
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2013-08-27 08:32:27 UTC
+++ This bug was initially created as a clone of Bug #835827 +++

This is a place holder for the upcoming polkit pkcheck race fix
which is discussed with upstream.
Comment 1 Sebastian Krahmer 2013-08-27 08:34:51 UTC
VUL-1 should suffice
Comment 2 Swamp Workflow Management 2013-08-27 22:00:12 UTC
bugbot adjusting priority
Comment 3 Sebastian Krahmer 2013-08-28 06:11:01 UTC
EMBARGOED, CRD will follow
Comment 4 Sebastian Krahmer 2013-09-09 07:38:10 UTC
CVE-2013-4288
Comment 5 Sebastian Krahmer 2013-09-09 07:38:20 UTC
CRD Sept 11th
Comment 7 Sebastian Krahmer 2013-09-10 11:16:32 UTC
The patch comes from polkit upstream:

http://people.freedesktop.org/~walters/secret/38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b/

There was a mail on libvirt-security list today which follows in next
comment.
Comment 9 Sebastian Krahmer 2013-09-10 11:21:21 UTC
Created attachment 556677 [details]
0001-git-master-Also-store-user-group-ID-values-in-virIdentity.patch
Comment 10 Sebastian Krahmer 2013-09-10 11:22:20 UTC
Created attachment 556678 [details]
0001-rhel6-Include-process-start-time-when-doing-polkit-checks.patch
Comment 11 Sebastian Krahmer 2013-09-10 11:23:24 UTC
Created attachment 556679 [details]
0002-git-master-Ensure-system-identity-includes-process-start-time.patch
Comment 12 Sebastian Krahmer 2013-09-10 11:23:56 UTC
Created attachment 556680 [details]
0002-rhel6-Add-support-for-using-3-arg-pkcheck-syntax-for-proce.patch
Comment 13 Sebastian Krahmer 2013-09-10 11:24:47 UTC
Created attachment 556681 [details]
0003-git-master-Add-support-for-using-3-arg-pkcheck-syntax-for-proce.patch
Comment 14 Sebastian Krahmer 2013-09-10 11:25:31 UTC
Thats all the patches we got from libvirt-security list.
Comment 15 Sebastian Krahmer 2013-09-10 11:57:28 UTC
I just see that they also include the libvirt patches in the git. Good.
Comment 16 Sebastian Krahmer 2013-09-11 06:27:44 UTC
new CRD coming and new CVE:

CVE-2013-4311 libvirt: insecure calling of polkit via libgobject API
Comment 18 Sebastian Krahmer 2013-09-11 14:37:56 UTC
New CRD: Sept 18th.

Updated patches will be pushed to git from comment#7
Comment 19 James Fehlig 2013-09-17 17:13:52 UTC
I think this only affects openSUSE 12.2, 12.3, and Factory/13.1, where we use the newer PolicyKit with libvirt.  In SLE 11, libvirt integrates with the old "polkit0", which doesn't use pkcheck.
Comment 22 James Fehlig 2013-10-02 21:24:16 UTC
Sigh... Several hours of wasted time backporting the fix to 12.2 and testing it.  Anyhow, it is done now for all affected products:

openSUSE12.2, SR#201960
openSUSE12.3, SR#201961
openSUSE13.1/Factory, SR#201962

I'm done here, reassigning to security team.
Comment 23 Bernhard Wiedemann 2013-10-02 22:00:37 UTC
This is an autogenerated message for OBS integration:
This bug (836931) was mentioned in
https://build.opensuse.org/request/show/201960 12.2 / libvirt
https://build.opensuse.org/request/show/201961 12.3 / libvirt
https://build.opensuse.org/request/show/201962 Factory / libvirt
Comment 24 Swamp Workflow Management 2013-10-15 15:04:21 UTC
openSUSE-SU-2013:1549-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 836931,838638
CVE References: CVE-2013-4296,CVE-2013-4311
Sources used:
openSUSE 12.2 (src):    libvirt-0.9.11.9-1.13.1
Comment 25 Swamp Workflow Management 2013-10-15 15:05:34 UTC
openSUSE-SU-2013:1550-1: An update that solves three vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 810611,820888,836931,837999,838638
CVE References: CVE-2013-4296,CVE-2013-4311,CVE-2013-5651
Sources used:
openSUSE 12.3 (src):    libvirt-1.0.2-1.10.1
Comment 26 Swamp Workflow Management 2013-11-08 20:00:48 UTC
Update released for: libvirt, libvirt-client, libvirt-client-32bit, libvirt-client-x86, libvirt-debuginfo, libvirt-debugsource, libvirt-devel, libvirt-devel-32bit, libvirt-doc, libvirt-lock-sanlock, libvirt-python
Products:
SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
Comment 27 Sebastian Krahmer 2014-01-07 10:24:49 UTC
fixed