Re: What is the "Grinch" polkit/wheel group issue?

[Dean Pierce <pierce403 () gmail com>]

The key here is the line:

"In order to exploit this, all we need is a single vulnerability in
any package in a repo. There are tons to choose from. If we type
‘PKCon’ or simply ‘man PKCon,’ we can find a list of repos in use and
then pull a list of all bins and version numbers. I won’t provide one
here because you don’t want everything handed to you."

Had they actually found a package they could leverage to get root,
then this would absolutely be a vulnerability, but they didn't.  While
configuring pkcon to allow admins to install packages without typing
in a password *is* something that might be unexpected for people
unfamiliar with polkit, that is the exact type of use case it was
built for.

  - DEAN

On Wed, Dec 17, 2014 at 10:24 AM, Kurt Seifried <kseifried () redhat com> wrote:
> On 17/12/14 10:00 AM, Marcus Meissner wrote:
> > Hi,
> >
> > This probably needs a CVE too, or does it have one?
> >
> > https://www.alertlogic.com/blog/dont-let-grinch-steal-christmas/
> > http://www.pcworld.com/article/2860032/this-linux-grinch-could-put-a-hole-in-your-security-stocking.html
> >
> > Although it seems that the user is in the "wheel" group for this to be exploitable
> > and is hard to specify what actions should be safed by another query or which should not.
> >
> > Ciao, Marcus
>
> Yeah I looked into this (the article/etc was completely confusing and
> took some time to parse):
>
> 1) the article states they contacted red hat, we were unable to find
> any inbound email or bugzilla entry pertaining to this issue, as always
> if you have an issue you wish to report please contact secalert () redhat com
>
> 2) this is expected behaviour, admin users can install software (do I
> have to say this? really? yes. I was told I should say this).
>
> 3) don't run web apps as admin users (do I have to say this? really?
> yes. I was told I should say this).
>
> 4) if you feel the need to run a web app as an admin user restrict what
> they can do via SELinux, and  don't let them install software (do I have
> to say this? really? yes. I was told I should say this).
>
> So TL;DR: it's not a security vulnerability, and it will NOT be getting
> a CVE.
>
> I can only assume this article/vuln is perhaps referring to something
> like Cpanel and other control panels that people sometimes install
> insecurely/improperly and then never update. Or something. Who knows.
>
> --
> Kurt Seifried -- Red Hat -- Product Security -- Cloud
> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993