CVE-2018-14348: Infoleak
libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information.
Other sources
The cgrulesengd daemon (cgred) in libcgroup through version 0.41 creates log files (/var/log/cgred) with world readable and writable permissions (0o666) due to a reset of the file mode creation mask (umask(0)) in the daemon/cgrulesengd.c:cgrestartdaemon() function.
Upstream Patch:
https://sourceforge.net/p/libcg/libcg/ci/0d88b73d189ea3440ccaab00418d6469f76fa590/
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14348?
CVE-2018-14348 is considered a medium severity vulnerability due to the potential information disclosure.
How do I fix CVE-2018-14348?
To fix CVE-2018-14348, update libcgroup to a version later than 0.41 that addresses this permission issue.
What systems are affected by CVE-2018-14348?
CVE-2018-14348 affects libcgroup versions up to and including 0.41 on various Linux distributions including Debian 8.0 and Fedora 28.
What type of vulnerability is CVE-2018-14348?
CVE-2018-14348 is a file permission vulnerability that allows unauthorized access to cgred log files.
What are the consequences of CVE-2018-14348?
The consequence of CVE-2018-14348 is that sensitive information may be exposed due to log files being world-readable and writable.