ansible: insecure temporary directory when running become_user from become directive
Published Mar 11, 2020
1.0
LOWCVSS 4.0
EPSS 0.40%
Description
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
Affected products
-
- Version 2.7.17 and priorStatusaffectedConstraints-
- Version 2.8.9 and priorStatusaffectedConstraints-
- Version 2.9.6 and priorStatusaffectedConstraints-
- Version
Configuration 1
- ≤ 2.7.16
- ≥ 2.8.0 · < 2.8.8
- ≥ 2.9.0 · ≤ 2.9.5
- ≤ 3.3.4
- ≥ 3.3.5 · ≤ 3.4.5
- ≥ 3.5.0 · ≤ 3.5.5
- ≥ 3.6.0 · ≤ 3.6.3
- 5.0
- 13
Configuration 2
- 30
- 31
- 32
Configuration 3
- 8.0
- 10.0
No data.
Red Hat Ansible Engine 2 for RHEL 7
ansible-0:2.9.7-1.el7ae
Fixed · RHSA-2020:1542
Red Hat Ansible Engine 2 for RHEL 8
ansible-0:2.9.7-1.el8ae
Fixed · RHSA-2020:1542
Red Hat Ansible Engine 2.7 for RHEL 7
ansible-0:2.7.17-1.el7ae
Fixed · RHSA-2020:1544
Red Hat Ansible Engine 2.8 for RHEL 7
ansible-0:2.8.11-1.el7ae
Fixed · RHSA-2020:1543
Red Hat Ansible Engine 2.8 for RHEL 8
ansible-0:2.8.11-1.el8ae
Fixed · RHSA-2020:1543
Red Hat Ansible Engine 2.9 for RHEL 7
ansible-0:2.9.7-1.el7ae
Fixed · RHSA-2020:1541
Red Hat Ansible Engine 2.9 for RHEL 8
ansible-0:2.9.7-1.el8ae
Fixed · RHSA-2020:1541
CloudForms Management Engine 5
ansible-tower
Not affected
Red Hat Ansible Tower 3
ansible
Affected
Red Hat Ceph Storage 2
ansible
Out of support scope
Red Hat Ceph Storage 3
ansible
Will not fix
Red Hat OpenStack Platform 10 (Newton)
ansible
Out of support scope
Red Hat OpenStack Platform 13 (Queens)
ansible
Will not fix
Red Hat Storage 3
ansible
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Ansible Engine 2 for RHEL 7 | ansible-0:2.9.7-1.el7ae | Fixed | RHSA-2020:1542 |
| Red Hat Ansible Engine 2 for RHEL 8 | ansible-0:2.9.7-1.el8ae | Fixed | RHSA-2020:1542 |
| Red Hat Ansible Engine 2.7 for RHEL 7 | ansible-0:2.7.17-1.el7ae | Fixed | RHSA-2020:1544 |
| Red Hat Ansible Engine 2.8 for RHEL 7 | ansible-0:2.8.11-1.el7ae | Fixed | RHSA-2020:1543 |
| Red Hat Ansible Engine 2.8 for RHEL 8 | ansible-0:2.8.11-1.el8ae | Fixed | RHSA-2020:1543 |
| Red Hat Ansible Engine 2.9 for RHEL 7 | ansible-0:2.9.7-1.el7ae | Fixed | RHSA-2020:1541 |
| Red Hat Ansible Engine 2.9 for RHEL 8 | ansible-0:2.9.7-1.el8ae | Fixed | RHSA-2020:1541 |
| CloudForms Management Engine 5 | ansible-tower | Not affected | n/a |
| Red Hat Ansible Tower 3 | ansible | Affected | n/a |
| Red Hat Ceph Storage 2 | ansible | Out of support scope | n/a |
| Red Hat Ceph Storage 3 | ansible | Will not fix | n/a |
| Red Hat OpenStack Platform 10 (Newton) | ansible | Out of support scope | n/a |
| Red Hat OpenStack Platform 13 (Queens) | ansible | Will not fix | n/a |
| Red Hat Storage 3 | ansible | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected. Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected. In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.
Red Hat mitigation
This issue can be mitigated by mounting the proc filesystem with hidepid=2 option (https://www.kernel.org/doc/Documentation/filesystems/proc.txt). This way only the user used by Ansible will be able to perform the attack as users on the system will be able to access only their processes /proc/$PID/ directories. Also note that mounting proc filesystem with hidepid=2 might require re-mounting it on unpatched kernels, due to a kernel bug (see https://unix.stackexchange.com/questions/584054/why-procfs-mount-option-only-working-on-remount), there will be hidepid=3 in the future (https://patchwork.kernel.org/patch/11310217/).
References (21)
- https://access.redhat.com/security/cve/CVE-2020-1733 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1801735 Issue Tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1733 x_refsource_CONFIRMIssue TrackingVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0027 Advisory
- https://github.com/advisories/GHSA-g4mq-6fp5-qwcf Advisory
- https://github.com/ansible/ansible/commit/80b9a0a25c5f75e84aefc8f2b293fb1933b154f2
- https://github.com/ansible/ansible/commit/8251d9f4c2bc82632ab992277fcd30ccbf87aa47
- https://github.com/ansible/ansible/commit/ecf99d5e1ff732a7777010facd6c98bb0994605e
- https://github.com/ansible/ansible/issues/67791 x_refsource_MISCExploitThird Party Advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-5.yaml
- https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB
- https://nvd.nist.gov/vuln/detail/CVE-2020-1733
- https://security.gentoo.org/glsa/202006-11 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-1733
- https://www.debian.org/security/2021/dsa-4950 vendor-advisoryx_refsource_DEBIANThird Party Advisory
Change history (0)
No recorded changes yet.