CVE-2015-7529: High severity sos-collector vulnerability
A vulnerability in sosreport was reported, allowing a privilege escalation to unprivileged attacker on RHEL-6, and change the owner and content of certain files on RHEL-7.
sosreport creates temporary directory in /tmp with predictable name sosreport-$hostname-$date with permissions set to 700. Then it creates a tar file with the aforementioned name + .tar suffix. Further it invokes open() with no ONOFOLLOW nor OEXCL set, which can be exploited by placing a file or a symlink in its place.
Attacker can create his own file to steal the content or can create a symlink to create/modify arbitrary files. On RHEL-7, there is fs.protectedsymlinks sysctl provided, which closes this vector. With the setting target of the symlink must match symlink's owner. On RHEL-6 this feature is missing, so the attacker is able to modify arbitrary files and escalate privileges.
Other sources
sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date.
— GitHub
sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7529?
CVE-2015-7529 is classified as a privilege escalation vulnerability affecting certain versions of sosreport.
How do I fix CVE-2015-7529?
To mitigate CVE-2015-7529, you should update the sosreport package to version 3.4 or later.
Which systems are vulnerable to CVE-2015-7529?
CVE-2015-7529 affects Red Hat Enterprise Linux 6 and 7, as well as Ubuntu 14.04, 15.04, and 15.10.
What types of attacks can exploit CVE-2015-7529?
An unprivileged attacker can exploit CVE-2015-7529 to change ownership and content of certain files.
What is the impact of CVE-2015-7529?
The impact of CVE-2015-7529 includes the ability for an attacker to escalate privileges and manipulate files on affected systems.