REDHAT-BUG-1487246: Medium severity open-iscsi tcmu-runner vulnerability
A local non-root user with access to the D-Bus system bus can call the CheckConfig method implemented in the tcmu-runner daemon via handlerglfs.so and cause various kinds of segmentation faults, depending on the string passed to the method.
For example the "hosts" variable in glfscheckconfig() is not zero initialized, but always freed on error, causing invalid free and/or invalid memory accesses.
Upstream patch:
https://github.com/open-iscsi/tcmu-runner/commit/61bd03e600d2abf309173e9186f4d465bb1b7157
References:
http://seclists.org/oss-sec/2017/q3/207
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1487246?
The severity of REDHAT-BUG-1487246 is medium with a risk rating of 4.
Who can exploit REDHAT-BUG-1487246?
A local non-root user with access to the D-Bus system bus can exploit REDHAT-BUG-1487246.
What impact does REDHAT-BUG-1487246 have?
Exploitation of REDHAT-BUG-1487246 can lead to segmentation faults depending on the input to the CheckConfig method.
How can I mitigate the risks associated with REDHAT-BUG-1487246?
Mitigation involves restricting access to the D-Bus system bus for non-root users who do not need it.
What software is affected by REDHAT-BUG-1487246?
The vulnerability REDHAT-BUG-1487246 affects the open-iscsi tcmu-runner software.