CVE-2021-3621: Command Injection
sssctlruncommand() is a wrapper for running commands via a shell, using glibc's system() function call. sssctlcacheexpire() and sssctllogsfetch() allow user provided arguments, and pass them to sssctlruncommand() sssctl is limited to root user, however, if an administrator allows unprivileged users to provide arguments to the command (e.g.: via sudo), this could be used to elevate privileges via a shell injection.
Although there are no known default configuration where this flaw could be exploited, the admin could have manually created sudo rules to let regular users use sssctl commands, or could be tricked into running a specially crafted sssctl command.
References:
https://sssd.io/release-notes/sssd-2.6.0.html
Other sources
A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3621?
CVE-2021-3621 is a vulnerability in SSSD where the sssctl command is vulnerable to shell command injection.
How does CVE-2021-3621 affect SSSD?
CVE-2021-3621 allows an attacker to trick the root user into running a specially crafted sssctl command to gain root access.
What is the severity of CVE-2021-3621?
CVE-2021-3621 has a severity rating of critical with a score of 8.8.
How can I fix CVE-2021-3621?
To fix CVE-2021-3621, update SSSD to version 2.6.0 or apply the recommended patch from Red Hat.
Where can I find more information about CVE-2021-3621?
You can find more information about CVE-2021-3621 in the release notes, Red Hat advisory, and Bugzilla report.