Bug 1131356 (CVE-2018-16877) - VUL-0: CVE-2018-16877: pacemaker: Insufficient local IPC client-server authentication on the client's side
Summary: VUL-0: CVE-2018-16877: pacemaker: Insufficient local IPC client-server authe...
Status: RESOLVED FIXED
Alias: CVE-2018-16877
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Yan Gao
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/228699/
Whiteboard: CVSSv3.1:SUSE:CVE-2018-16877:7.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2019-04-03 05:25 UTC by Karol Babioch
Modified: 2024-05-29 17:02 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Karol Babioch 2019-04-03 05:25:54 UTC
CVE-2018-16877

1. CVE-2018-16877 pacemaker: Insufficient local IPC client-server
authentication on the client's side can lead to local privesc:
A flaw was found in the way pacemaker's client-server authentication was
implemented. A local attacker could use this flaw, and combine it with
other IPC weaknesses, to achieve local privilege escalation.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16877
Comment 1 Karol Babioch 2019-04-03 05:30:00 UTC
CRD: 2019-04-10 10:00 UTC
Comment 3 Karol Babioch 2019-04-03 05:39:22 UTC
Created attachment 802030 [details]
High-pacemakerd-vs.-IPC-procfs-confused-deputy-authentic-v8-branch-1.1.patch
Comment 4 Yan Gao 2019-04-03 18:00:19 UTC
(In reply to Karol Babioch from comment #3)
> Created attachment 802030 [details]
> High-pacemakerd-vs.-IPC-procfs-confused-deputy-authentic-v8-branch-1.1.patch
This is the patch for pacemaker 1.1 branch, which can be relatively easily back-ported for the code base of SLE12SP4.

I wonder if the author provided a patch for pacemaker master branch, which is closer to the code base of SLE15. Otherwise we'd have to use the relatively heavily back-ported patch from me:
https://build.suse.de/package/view_file/home:yan_gao:branches:SUSE:SLE-15:Update:Test/pacemaker/bsc%231131353-bsc%231131356-High-pacemakerd-vs.-IPC-procfs-confused-deputy-authentic-v8-branch-1.1.patch
Comment 6 Karol Babioch 2019-04-03 20:08:32 UTC
(In reply to Yan Gao from comment #4)
> I wonder if the author provided a patch for pacemaker master branch, which
> is closer to the code base of SLE15. Otherwise we'd have to use the
> relatively heavily back-ported patch from me:
> https://build.suse.de/package/view_file/home:yan_gao:branches:SUSE:SLE-15:
> Update:Test/pacemaker/bsc%231131353-bsc%231131356-High-pacemakerd-vs.-IPC-
> procfs-confused-deputy-authentic-v8-branch-1.1.patch

No further patches have been provided. I can ask for it, and/or we just wait until this becomes public. At least in my view this is not uber critical and I'm not even convinved that the embargo makes sense in the first place. But it is, what it is.
Comment 7 Yan Gao 2019-04-05 15:14:03 UTC
(In reply to Karol Babioch from comment #3)
> Created attachment 802030 [details]
> High-pacemakerd-vs.-IPC-procfs-confused-deputy-authentic-v8-branch-1.1.patch
The patch seems to have potential issue. Could you please tell the author there's changes of behavior with the patch? Thanks.

With a running cluster stack:

The old behavior:

1. killall -9 corosync
2. crmd exits and a new crmd gets respawned (NO.2)
3. corosync starts again and new pacemakerd finds the pre-existing crmd (NO.2) and continues working.

With the patch, the new behavior:
1. killall -9 corosync
2. crmd exits and a new crmd(NO.2) gets respawned
3. corosync starts again and new pacemakerd spawns a duplicate crmd which complains:

Apr 05 15:24:46 node1 crmd[23500]:    error: Could not bind AF_UNIX (): Address already in use (98)
Apr 05 15:24:46 node1 crmd[23500]:    error: Could not start crmd IPC server: Address already in use (-98)

4.  The duplicate crmd exits, and another new duplicate crmd gets respawned, retries and exits and again ...

5.  Eventually crmd(NO.2)  fails and exits and a newly respawned crmd starts working.
Comment 8 Karol Babioch 2019-04-09 08:41:38 UTC
(In reply to Yan Gao from comment #7)
> The patch seems to have potential issue. Could you please tell the author
> there's changes of behavior with the patch? Thanks.

I've forwarded your findings to the original reporter and the distros list. I will let you know once there has been any feedback.

Best regards,
Karol Babioch
Comment 9 Karol Babioch 2019-04-10 08:48:07 UTC
Due to some concerns related to the patchset, the CRD has been moved.

CRD: 2019-04-16 10:00 UTC
Comment 10 Karol Babioch 2019-04-16 09:58:28 UTC
CRD: 2019-04-17 10:00
Comment 11 Karol Babioch 2019-04-17 09:46:50 UTC
Public now.
Comment 15 Swamp Workflow Management 2019-04-26 13:17:08 UTC
SUSE-SU-2019:1047-1: An update that solves three vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1117381,1117934,1128374,1128772,1131353,1131356,1131357
CVE References: CVE-2018-16877,CVE-2018-16878,CVE-2019-3885
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    pacemaker-1.1.19+20181105.ccd6b5b10-3.10.1
SUSE Linux Enterprise High Availability 12-SP4 (src):    pacemaker-1.1.19+20181105.ccd6b5b10-3.10.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2019-04-30 16:10:43 UTC
SUSE-SU-2019:1108-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1131353,1131356
CVE References: CVE-2018-16877,CVE-2018-16878
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    pacemaker-1.1.16-6.14.1
SUSE Linux Enterprise High Availability 12-SP3 (src):    pacemaker-1.1.16-6.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 18 Swamp Workflow Management 2019-05-02 13:30:11 UTC
This is an autogenerated message for OBS integration:
This bug (1131356) was mentioned in
https://build.opensuse.org/request/show/700145 Factory / pacemaker
Comment 19 Swamp Workflow Management 2019-05-08 13:10:58 UTC
openSUSE-SU-2019:1342-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1131353,1131356
CVE References: CVE-2018-16877,CVE-2018-16878
Sources used:
openSUSE Leap 42.3 (src):    pacemaker-1.1.16-4.12.1
Comment 20 Swamp Workflow Management 2019-05-10 19:11:33 UTC
SUSE-SU-2019:1209-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1117381,1131353,1131356,1131357
CVE References: CVE-2018-16877,CVE-2018-16878,CVE-2019-3885
Sources used:
SUSE Linux Enterprise High Availability 15 (src):    pacemaker-1.1.18+20180430.b12c320f5-3.9.4

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 21 Swamp Workflow Management 2019-05-15 19:10:08 UTC
openSUSE-SU-2019:1400-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1117381,1131353,1131356,1131357
CVE References: CVE-2018-16877,CVE-2018-16878,CVE-2019-3885
Sources used:
openSUSE Leap 15.0 (src):    pacemaker-1.1.18+20180430.b12c320f5-lp150.2.9.1
Comment 24 Swamp Workflow Management 2019-09-02 16:21:04 UTC
SUSE-SU-2019:2268-1: An update that solves two vulnerabilities and has 7 fixes is now available.

Category: security (important)
Bug References: 1032511,1127716,1130122,1131353,1131356,1133866,1135317,1136712,1140519
CVE References: CVE-2018-16877,CVE-2018-16878
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    pacemaker-1.1.19+20181105.ccd6b5b10-3.13.1
SUSE Linux Enterprise High Availability 12-SP4 (src):    pacemaker-1.1.19+20181105.ccd6b5b10-3.13.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 28 Swamp Workflow Management 2019-09-19 10:11:36 UTC
SUSE-RU-2019:2405-1: An update that has 7 recommended fixes can now be installed.

Category: recommended (moderate)
Bug References: 1032511,1127716,1130122,1131353,1131356,1133866,1136712
CVE References: 
Sources used:
SUSE Linux Enterprise High Availability 15 (src):    pacemaker-1.1.18+20180430.b12c320f5-3.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 29 Swamp Workflow Management 2019-09-29 13:12:55 UTC
openSUSE-RU-2019:2214-1: An update that has 7 recommended fixes can now be installed.

Category: recommended (moderate)
Bug References: 1032511,1127716,1130122,1131353,1131356,1133866,1136712
CVE References: 
Sources used:
openSUSE Leap 15.0 (src):    pacemaker-1.1.18+20180430.b12c320f5-lp150.2.12.1
Comment 32 Swamp Workflow Management 2020-04-22 22:18:08 UTC
SUSE-SU-2020:1072-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1131353,1131356
CVE References: CVE-2018-16877,CVE-2018-16878
Sources used:
SUSE Linux Enterprise High Availability 12-SP2 (src):    pacemaker-1.1.15-23.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.