Bug 1196241 (CVE-2022-0563) - VUL-0: CVE-2022-0563: util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline
Summary: VUL-0: CVE-2022-0563: util-linux: partial disclosure of arbitrary files in ch...
Status: RESOLVED WORKSFORME
Alias: CVE-2022-0563
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Stanislav Brabec
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/323744/
Whiteboard: CVSSv3.1:SUSE:CVE-2022-0563:5.5:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2022-02-21 12:09 UTC by Robert Frohl
Modified: 2023-04-06 10:19 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2022-02-21 12:09:11 UTC 
rh#2053151

A flaw was found in util-linux's chfn/chsh utilities when compiled with readline support. The readline library accepts an INPUTRC parameter as an environment variable. Passing this environment variable causes readline to load the file in the chfn process, which is running as UID 0. Parsing this file will lead to errors being printed to standard output when reading lines that begin with certain strings such as "-" and lines that do not contain an expected character. These error messages *contain parts of the file*, which is the core of the issue. An unprivileged user could use this flaw to read root-owned files, potentially leading to privilege escalation.

Reference:
https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2053151
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0563
Comment 2 Robert Frohl 2022-02-21 12:55:54 UTC 
for SLE12* and SLE15* chsh and chfn are provided by shadow, so not affected there.
Comment 4 Stanislav Brabec 2022-02-22 01:09:07 UTC 
util-linux:

SLE12 SP3 to SP5, SLE15 *, Factory: We explicitly use --disable-chfn-chsh

SLE12 SP1 to SP2: We delete them by
  rm -f %{buildroot}%{_bindir}/{chfn,chsh,newgrp}

SLE11 *: The build is disabled by default, requires --enable-login-utils to be enabled. Not used by SUSE.

SLE10 *: The target all-putils is not built.

=> SUSE util-linux is not affected by this bug at all.


The chfn/chsh are provided by shadow in recent products. In the old products (SLE10 *, SLE 11 *) it is provided by pwdutils.