REDHAT-BUG-1633243: Medium severity sosreport sos-collector vulnerability
sos-collector does not set any permission when creating new files, thus the default umask is used, making all newly created files readable by all local users. Given the delicacy of the data collected by sos-collector, all files created by the tool, including the sos-reports collected from the cluster machines, should be accessible only the to current user. A local attacker can use this flaw to read sensitive information collected from other machines when a legit user runs sos-collector.
Upstream patch: https://github.com/sosreport/sos-collector/commit/72058f9253e7ed8c7243e2ff76a16d97b03d65ed
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker who can access the system where sos-collector is run may read sensitive data collected by another user. The issue concerns files created during collection, including sos-reports retrieved from cluster machines.
What conditions are required for exposure?
A legitimate user must run sos-collector, and the process must create files under a default umask that permits other local users to read them. The vulnerability results from sos-collector not explicitly setting restrictive permissions on newly created files.
What can be done if patching is delayed?
Use a restrictive umask when running sos-collector and ensure that the directories and files used for collected reports are accessible only to the user performing the collection. Limit local access to systems where sos-collector reports are generated or stored.
How can I determine whether collected data may be exposed?
Inspect permissions on files created by sos-collector, including collected sos-reports from cluster machines. Files readable by users other than the collecting user may expose sensitive collected information.