Bugzilla – Bug 882667
VUL-0: CVE-2014-4038: ppc64-diag: /tmp race in ppc64-diag
Last modified: 2015-02-19 01:50:21 UTC
ppc64-diag-2.6.6/rtas_errd/diag_support.c char command[]="/usr/bin/find /proc/device-tree -name status -print > /tmp/get_dt_files"; if (system(command) != 0) { fprintf(stderr, "get_dt_status find command failed\n"); return NULL; } /* results of the find command */ fp1 = fopen("/tmp/get_dt_files", "r"); if (fp1 == 0) { fprintf(stderr, "open failed on /tmp/get_dt_files\n"); return NULL; } Please just use popen() and no /tmp file.
see bug 882450
scripts/ppc64_diag_mkrsrc also uses /tmp unsafely. lpd/test/lpd_ela_test.sh same (mkdir -p return value should be checked and handled)
Created attachment 594718 [details] ppc64-diag-tmpraces.patch patch i did, untested.
bugbot adjusting priority
Date: Tue, 17 Jun 2014 01:17:57 -0400 (EDT) From: cve-assign@mitre.org The ppc64-diag unsafe uses of temporary directories in these three scenarios: "> /tmp/get_dt_files" [ in rtas_errd/diag_support.c ] mkdir "/tmp/diagSEsnap", 0775; $general_eed_file = "/tmp/diagSEsnap/snapH.tar.gz"; system("/usr/sbin/snap -o $general_eed_file 2>/dev/null 1>&2"); [ in scripts/ppc64_diag_mkrsrc ] TMP_DIR="/var/tmp/ras" mkdir -p $TMP_DIR MESSAGE_FILE="$TMP_DIR/messages" [ in lpd/test/lpd_ela_test.sh - see Novell bug 882667 ] are primarily of interest because of symlink following, and are all assigned CVE-2014-4038. A second CVE for the ppc64-diag product is for the choice of weak directory/file permissions for the snapH.tar.gz archive including data that is not locally world-readable (e.g., /var/log/messages). This is CVE-2014-4039.
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2014-06-24. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/57887
Comment from VASANT HEGDE 2014-06-20 01:24:17 EDT Attached patch looks good ... SUSE, please proceed..
------- Comment From hannsj_uhl@de.ibm.com 2014-06-20 07:18 EDT-------
(In reply to comment #8) > Comment from VASANT HEGDE 2014-06-20 01:24:17 EDT > > Attached patch looks good ... SUSE, please proceed.. . Hello SUSE / Marcus, short question .. ... will this patch be included in SLES 12 RC1 ..? Please advise .. Thanks in advance for your support.
Hanns, yes, it will.
Done.
thanks! reassign to security for tracking
Created attachment 599147 [details] Updated patch Reworked the patch to include the permission fixes and to ensure that all pipes and open files get closed upon return
in qa
This is an autogenerated message for OBS integration: This bug (882667) was mentioned in https://build.opensuse.org/request/show/241884 Factory / ppc64-diag
SUSE-SU-2014:0928-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 882667 CVE References: CVE-2014-4038,CVE-2014-4039 Sources used: SUSE Linux Enterprise Server 11 SP3 (src): ppc64-diag-2.6.1-0.14.1
fixed
openSUSE-SU-2014:0953-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 882667 CVE References: CVE-2014-4038,CVE-2014-4039 Sources used: openSUSE 13.1 (src): ppc64-diag-2.6.1-2.4.1
openSUSE-SU-2014:0953-2: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 882667 CVE References: CVE-2014-4038,CVE-2014-4039 Sources used: openSUSE 12.3 (src): ppc64-diag-2.6.0-2.4.1