A vulnerability in sosreport was reported, allowing a privilege escalation to unprivileged attacker on RHEL-6, and change the owner and content of certain files on RHEL-7.

sosreport creates temporary directory in /tmp with predictable name sosreport-$hostname-$date with permissions set to 700. Then it creates a tar file with the aforementioned name + .tar suffix. Further it invokes open() with no ONOFOLLOW nor OEXCL set, which can be exploited by placing a file or a symlink in its place.

Attacker can create his own file to steal the content or can create a symlink to create/modify arbitrary files. On RHEL-7, there is fs.protectedsymlinks sysctl provided, which closes this vector. With the setting target of the symlink must match symlink's owner. On RHEL-6 this feature is missing, so the attacker is able to modify arbitrary files and escalate privileges.

It was reported that sosreport creates output files with world-readable permissions:

-rw-r--r--. 1 root root 7331624 May 4 08:55 sosreport-localhost.localdomain-20150504084328.tar.xz -rw-r--r--. 1 root root 33 May 4 08:55 sosreport-localhost.localdomain-20150504084328.tar.xz.md5

The archive may consists of files originally only accessible by the root user. However, after extracting the archive, all of the files are readable by regular users with access to /var/tmp/.

Acknowledgements:

Red Hat would like to thank Grant Murphy for reporting this issue.

It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.

A flaw was found in the ovirt-log-collector, which led to the logging of plaintext passwords in the log file. This flaw allows an attacker with sufficient privileges to read the log file, leading to a loss of confidentiality.