Bugzilla – Bug 1135729
VUL-0: CVE-2019-12209: pam_u2f: symlinks are followed
Last modified: 2020-10-19 16:10:52 UTC
Split-off from audit bug 1087061: This issue is for tracking the following of symlinks in the user's home directory for the auth_file: ``` the file `$HOME/.config/Yubico/u2f_keys` is blindly followed by the pam module. It can be a symlink pointing to an arbitrary file. The PAM module only rejects non- regular files and files owned by other users than root or the to-be- authenticated user. Even these checks are only made after open()ing the file, which may already trigger certain logic in the kernel that is otherwise not reachable to regular users. If `debug` is also enabled then most of the content of the file is written either to stdout, stderr, syslog or to the defined debug file. Therefore this can pose a big information leak to access e.g. the contents of /etc/shadow, /root/.bash_history or similar sensitive files. For example use the following line in the PAM stack: auth optional pam_u2f.so debug Then prepare a suitable symlink: user$ mkdir -p ~/.config/Yubico user$ ln -s /etc/shadow ~/.config/Yubico/u2f_keys Then authenticate the user on a text console: host login: user Password: XXX [...] debug(pam_u2f): Authorization line: avahi:!:18019:::::: [...] Notice the lines from /etc/shadow being output on the terminal. ``` This finding is still undisclosed and the publication date for this is: CRD: 2019-06-04
Addressed this in SLE codestreams: - https://build.suse.de/request/show/193686 - https://build.suse.de/request/show/193687 The openSUSE codestreams will either inherit it from SLE, or will be updated/bumped once this becomes public. Not sure what else will change with next upstream release, but personally I would prefer to bump the version instead of maintaining patches on top of an old release.
This is an autogenerated message for IBS integration: This bug (1135729) was mentioned in https://build.suse.de/request/show/193688 SLE-15 / pam_u2f
Upstream published the findings by now. The patches [1], [2] and the release notes [3] are available. [1]: https://github.com/Yubico/pam-u2f/commit/7db3386fcdb454e33a3ea30dcfb8e8960d4c3aa3 [2]: https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62 [3]: https://developers.yubico.com/pam-u2f/Release_Notes.html
SUSE-SU-2019:1750-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 1128140,1135727,1135729 CVE References: CVE-2019-12209,CVE-2019-12210,CVE-2019-9578 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): libu2f-host-1.1.6-3.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): libu2f-host-1.1.6-3.6.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): libu2f-host-1.1.6-3.6.1, pam_u2f-1.0.8-3.3.1 SUSE Linux Enterprise Module for Basesystem 15 (src): libu2f-host-1.1.6-3.6.1, pam_u2f-1.0.8-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1749-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1124781,1128140,1135727,1135729 CVE References: CVE-2018-20340,CVE-2019-12209,CVE-2019-12210,CVE-2019-9578 Sources used: SUSE Linux Enterprise Server 12-SP4 (src): libu2f-host-1.1.6-3.5.1, pam_u2f-1.0.8-3.3.1 SUSE Linux Enterprise Desktop 12-SP4 (src): libu2f-host-1.1.6-3.5.1, pam_u2f-1.0.8-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:1708-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 1128140,1135727,1135729 CVE References: CVE-2019-12209,CVE-2019-12210,CVE-2019-9578 Sources used: openSUSE Leap 15.1 (src): libu2f-host-1.1.6-lp151.2.6.1, pam_u2f-1.0.8-lp151.2.3.1
openSUSE-SU-2019:1725-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 1128140,1135727,1135729 CVE References: CVE-2019-12209,CVE-2019-12210,CVE-2019-9578 Sources used: openSUSE Leap 15.0 (src): libu2f-host-1.1.6-lp150.10.1, pam_u2f-1.0.8-lp150.7.1
Released.