CVE-2020-1733: Race Condition
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
Other sources
A race condition flaw was found in Ansible Engine when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
When a playbook runs a target on a Linux node with an unprivileged become user, a raced condition allows another user on the node to gain control of the become user. In addition, permissions of files owned by the original ssh user on the node can be modified.
When Ansible needs to run a module with become-user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>", this operation does not fail if the directory already exists and is owned by another user.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.7.17-1.el7ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.8.11-1.el7ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.8.11-1.el8ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.9.7-1.el7ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.9.7-1.el8ae - Upgrade
Upgrade
debian/ansibleto a version that resolves this vulnerability.Fixed in 2.7.7+dfsg-1+deb10u1Fixed in 2.7.7+dfsg-1+deb10u2Fixed in 2.10.7+merged+base+2.10.8+dfsg-1Fixed in 7.3.0+dfsg-1Fixed in 7.7.0+dfsg-3 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.7.17 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.8.11 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.8.11 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.7.17 - Upgrade
Upgrade
Ansible Engineto a version that resolves this vulnerability.Fixed in 2.9.7 - Compensating control
Mitigate the become-user race condition by mounting the proc filesystem with the hidepid=2 option (procfs hidepid=2 restricts access to /proc/$PID and limits which users can retrieve target directory data).
- Compensating control
If using the hidepid=2 mitigation on unpatched kernels, be prepared to re-mount procfs after patching or other changes due to the kernel bug described in the material (may require re-mounting for hidepid=2 to take effect).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-1733?
CVE-2020-1733 is a race condition vulnerability found in Ansible Engine when running a playbook with an unprivileged become user.
What is the severity of CVE-2020-1733?
CVE-2020-1733 has a medium severity rating.
Which versions of Ansible Engine are affected by CVE-2020-1733?
Ansible Engine 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior are affected by CVE-2020-1733.
How can I fix CVE-2020-1733?
To fix CVE-2020-1733, update Ansible Engine to versions 2.7.17, 2.8.11, or 2.9.7.
Where can I find more information about CVE-2020-1733?
You can find more information about CVE-2020-1733 on the Red Hat Bugzilla and GitHub pages.