CVE-2016-6299: Critical severity red hat fedora vulnerability
It was found that mock's scm plug-in would parse a given spec file with root priviliges. This could allow an attacker who is able to start a build of an rpm with a specially crafted spec file within mock's environment to elevate their priviliges and escape the chroot.
The vulnerable code in scm.py is:
ts = rpm.ts() rpmspec = ts.parseSpec(self.spec) # the spec file is parsed as root self.name = rpm.expandMacro("%{name}")
Other sources
The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6299?
CVE-2016-6299 is considered a high-severity vulnerability due to potential privilege escalation.
How do I fix CVE-2016-6299?
The recommended fix for CVE-2016-6299 is to update the mock package to a version where the vulnerability has been patched.
Who is affected by CVE-2016-6299?
CVE-2016-6299 affects users of Fedora versions 23, 24, and 25 that utilize the mock's scm plugin.
What can an attacker do with CVE-2016-6299?
An attacker can exploit CVE-2016-6299 to elevate privileges and escape the chroot environment when starting a build with a crafted spec file.
What software is involved in CVE-2016-6299?
CVE-2016-6299 involves the mock project scm plugin and affects specific versions of the Fedora operating system.