fwdbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.

Marco Slaviero reported a flaw in the use of python's pickle module as used in system-config-firewall that could allow local users to elevate their privileges to that of the root user. The pickle module is used to format messages between the system-config-firewall GUI and the system-config-firewall-mechanism.py privileged backend (that runs as root). The frontend and backend use D-Bus to communicate with each other, and pickle is known to permit the execution of arbitrary python code, so the untrusted user can send to the backend pickle shellcode that is executed in a privileged context.

The flaw depends on a number of non-standard configurable items to be set:

1) SELinux must be disabled (with SELinux enabled, certain actions can be executed as root, but they are extremely limited) 2) The user must be local, and using a GUI

Acknowledgements:

Red Hat would like to thank Marco Slaviero of SensePost for reporting this issue.