oss-sec mailing list archives
ClusterLabs/PCS: [CVE-2022-2735] Obtaining an authentication token for hacluster user leads to privilege escalation.
From: Tej Rathi <trathi () redhat com>
Date: Thu, 1 Sep 2022 19:30:58 +0530
Hello, A security issue was discovered in the ClusterLabs/PCS project. This is CVE-2022-2735, assigned by Red Hat. (https://github.com/ClusterLabs/pcs) *ROOT CAUSE & IMPACT:* *------------------------------------* It is caused by incorrect permissions on a unix socket used for internal communication between pcs daemons. Reproducer below demonstrates a privilege escalation by obtaining authentication token for hacluster user. With the hacluster token, an attacker has complete control over the cluster managed by pcs. CVSS Base Score [HIGH]: 8.4/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H *AFFECTED VERSIONS:* *---------------------------------* pcs upstream is affected since version 0.10.5 [1][2]. This means that all 0.10.x versions starting from 0.10.5 including the latest 0.10 branch release 0.10.14 are affected. And all 0.11.x versions are affected as well. POC and PATCH are in the attachment. *CREDITS:* *--------------* The issue was discovered by Ondrej Mular (Senior Software Engineer, Red Hat) *REFERENCES:* *---------------------* [1]: https://github.com/ClusterLabs/pcs/releases/tag/0.10.5 [2]: https://github.com/ClusterLabs/pcs/blob/main/CHANGELOG.md#0105---2020-03-18 - - - - - - - - - - - - - - - - Thanks & Regards, TEJ RATHI Associate Product Security Engineer | PSIRT Product Security Engineering, Red Hat.
Attachment:
patch
Description:
Attachment:
poc
Description:
Current thread:
- ClusterLabs/PCS: [CVE-2022-2735] Obtaining an authentication token for hacluster user leads to privilege escalation. Tej Rathi (Sep 01)