CVE-2012-5536: Input Validation
A certain Red Hat build of the pamsshagentauth module on Red Hat Enterprise Linux (RHEL) 6 and Fedora Rawhide calls the glibc error function instead of the error function in the OpenSSH codebase, which allows local users to obtain sensitive information from process memory or possibly gain privileges via crafted use of an application that relies on this module, as demonstrated by su and sudo.
Other sources
A symbol clash issue was found in the pamsshagentauth PAM module as shipped with Red Hat Enterprise Linux 6 and Fedora. In case of certain errors, pamsshagentauth calls error() function to report problems. Due to the way pamsshagentauth was built in Red Hat Enterprise Linux and Fedora packages, this led to glibc's error() function being called instead of the error() function from OpenSSH sources that was meant to be used. As the two error functions expect different arguments, this could cause an application configured to use the pamsshagentauth module (typically su or sudo) to crash, disclose portion of its memory, or, possibly, execute arbitrary code.
This issue did not affect upstream versions of pamsshagentauth and was specific to Red Hat Enterprise Linux / Fedora packages, where pamsshagentauth is part of the openssh source RPM. This bundling is used to avoid duplicating OpenSSH source code. pamsshagentauth embeds a copy of the OpenSSH code. It is not used in Red Hat Enterprise Linux / Fedora packages, instead OpenSSH code from the OpenSSH build is used. This flaw was consequence of this way the PAM module is built.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5536?
CVE-2012-5536 has a moderate severity rating due to potential local information leakage and privilege escalation.
How do I fix CVE-2012-5536?
To mitigate CVE-2012-5536, update the pam_ssh_agent_auth module to the latest version provided by Red Hat or Fedora.
What systems are affected by CVE-2012-5536?
CVE-2012-5536 affects Red Hat Enterprise Linux 6.0 and Fedora Rawhide installations.
What are the risks associated with CVE-2012-5536?
The risks include local users gaining access to sensitive information in process memory, which could lead to privilege escalation.
Is CVE-2012-5536 related to OpenSSH?
Yes, CVE-2012-5536 is related to a flaw in how the pam_ssh_agent_auth module interacts with the OpenSSH codebase.