Bug 1135727 (CVE-2019-12210) - VUL-0: CVE-2019-12210: pam_u2f: file descriptor leak
Summary: VUL-0: CVE-2019-12210: pam_u2f: file descriptor leak
Status: RESOLVED FIXED
Alias: CVE-2019-12210
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/233358/
Whiteboard: CVSSv2:NVD:CVE-2019-12210:5.5:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2019-05-21 08:47 UTC by Matthias Gerstner
Modified: 2020-10-19 16:11 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Gerstner 2019-05-21 08:47:35 UTC
Split-off from audit bug 1087061: This issue is for tracking the file descriptor leak:

```
- if the `debug` and `debug_file` options are set then the opened debug file
  will be inherited to the successfully authenticated user's process. Therefore
  this user can access write further information to it, possibly filling up a
  file system.
```

Accessing the content of the debug file should not be possible, since the file descriptor is opened write only and Linux doesn't offer any way to change the access mode for open file descriptors.

This finding is still undisclosed and the publication date for this is:

CRD: 2019-06-04
Comment 2 Matthias Gerstner 2019-05-21 08:53:18 UTC
This here is a more complete description of the issue:

```
    if the `debug` and `debug_file` options are set then the opened debug
    file will be inherited to the successfully authenticated user's process.
    Therefore this user can manipulate the information in the debug file and
    also write further information to it, possibly filling up a privileged
    file system.
  
    In some contexts the program utilizing PAM closes off leaked file
    descriptors but it does work with su, for example:
  
    Use the following line in the PAM stack:
  
    auth    optional        pam_u2f.so debug debug_file=/tmp/u2f-debug.txt
  
    The prepare the debug file such that the PAM module can open it:
  
    root# touch /tmp/u2f-debug.txt
  
    Then perform su on yourself as an unprivileged user:
  
    user$ su user
    Password: XXX
    user$ ls -l /proc/$$/fd
    [...]
    l-wx------ 1 mgerstner users 64  8. Mai 11:44 3 -> /tmp/u2f-debug.txt
  
    As you can see the new user shell now has an open file handle for the
    debug file.
```
Comment 5 Karol Babioch 2019-05-28 19:53:07 UTC
Addressed this in SLE codestreams:

- https://build.suse.de/request/show/193686
- https://build.suse.de/request/show/193687

The openSUSE codestreams will either inherit it from SLE, or will be updated/bumped once this becomes public. Not sure what else will change with next upstream release, but personally I would prefer to bump the version instead of maintaining patches on top of an old release.
Comment 6 Bernhard Wiedemann 2019-05-28 20:35:08 UTC
This is an autogenerated message for IBS integration:
This bug (1135727) was mentioned in
https://build.suse.de/request/show/193688 SLE-15 / pam_u2f
Comment 7 Matthias Gerstner 2019-06-04 13:07:47 UTC
Upstream published the findings by now. The patches [1], [2] and the release
notes [3] are available.

[1]: https://github.com/Yubico/pam-u2f/commit/7db3386fcdb454e33a3ea30dcfb8e8960d4c3aa3
[2]: https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62
[3]: https://developers.yubico.com/pam-u2f/Release_Notes.html
Comment 9 Swamp Workflow Management 2019-07-04 19:11:19 UTC
SUSE-SU-2019:1750-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1128140,1135727,1135729
CVE References: CVE-2019-12209,CVE-2019-12210,CVE-2019-9578
Sources used:
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    libu2f-host-1.1.6-3.6.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    libu2f-host-1.1.6-3.6.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    libu2f-host-1.1.6-3.6.1, pam_u2f-1.0.8-3.3.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    libu2f-host-1.1.6-3.6.1, pam_u2f-1.0.8-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2019-07-04 19:12:23 UTC
SUSE-SU-2019:1749-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1124781,1128140,1135727,1135729
CVE References: CVE-2018-20340,CVE-2019-12209,CVE-2019-12210,CVE-2019-9578
Sources used:
SUSE Linux Enterprise Server 12-SP4 (src):    libu2f-host-1.1.6-3.5.1, pam_u2f-1.0.8-3.3.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    libu2f-host-1.1.6-3.5.1, pam_u2f-1.0.8-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2019-07-19 10:12:57 UTC
openSUSE-SU-2019:1708-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1128140,1135727,1135729
CVE References: CVE-2019-12209,CVE-2019-12210,CVE-2019-9578
Sources used:
openSUSE Leap 15.1 (src):    libu2f-host-1.1.6-lp151.2.6.1, pam_u2f-1.0.8-lp151.2.3.1
Comment 12 Swamp Workflow Management 2019-07-19 19:18:27 UTC
openSUSE-SU-2019:1725-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1128140,1135727,1135729
CVE References: CVE-2019-12209,CVE-2019-12210,CVE-2019-9578
Sources used:
openSUSE Leap 15.0 (src):    libu2f-host-1.1.6-lp150.10.1, pam_u2f-1.0.8-lp150.7.1
Comment 13 Wolfgang Frisch 2020-10-19 16:11:24 UTC
Released.