GSD-2018-12029
Vulnerability from gsd - Updated: 2018-06-12 00:00Details
The file system access race condition allows for local privilege escalation and affects the Nginx module for Passenger versions 5.3.1, all the way back to 3.0.0 (the chown command entered the code in 2010).
The vulnerability was exploitable only when running a non-standard `passenger_instance_registry_dir`, via a race condition where after a file was created, there was a window in which it could be replaced with a symlink before it was chowned via the path and not the file descriptor.
If the symlink target was to a file which would be executed by root such as root's crontab file, then privilege escalation was possible.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2018-12029",
"description": "A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root\u0027s crontab file allows privilege escalation.",
"id": "GSD-2018-12029",
"references": [
"https://www.suse.com/security/cve/CVE-2018-12029.html",
"https://ubuntu.com/security/CVE-2018-12029"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "passenger",
"purl": "pkg:gem/passenger"
}
}
],
"aliases": [
"CVE-2018-12029"
],
"details": "The file system access race condition allows for local privilege escalation and affects the Nginx module for Passenger versions 5.3.1, all the way back to 3.0.0 (the chown command entered the code in 2010).\nThe vulnerability was exploitable only when running a non-standard `passenger_instance_registry_dir`, via a race condition where after a file was created, there was a window in which it could be replaced with a symlink before it was chowned via the path and not the file descriptor.\nIf the symlink target was to a file which would be executed by root such as root\u0027s crontab file, then privilege escalation was possible.",
"id": "GSD-2018-12029",
"modified": "2018-06-12T00:00:00.000Z",
"published": "2018-06-12T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": 4.4,
"type": "CVSS_V2"
},
{
"score": 7.0,
"type": "CVSS_V3"
}
],
"summary": "CHMOD race vulnerability"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-12029",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root\u0027s crontab file allows privilege escalation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://blog.phusion.nl/passenger-5-3-2",
"refsource": "MISC",
"url": "https://blog.phusion.nl/passenger-5-3-2"
},
{
"name": "GLSA-201807-02",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201807-02"
},
{
"name": "https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc",
"refsource": "MISC",
"url": "https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc"
},
{
"name": "[debian-lts-announce] 20180627 [SECURITY] [DLA 1399-1] ruby-passenger security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html"
}
]
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2018-12029",
"cvss_v2": 4.4,
"cvss_v3": 7.0,
"date": "2018-06-12",
"description": "The file system access race condition allows for local privilege escalation and affects the Nginx module for Passenger versions 5.3.1, all the way back to 3.0.0 (the chown command entered the code in 2010).\nThe vulnerability was exploitable only when running a non-standard `passenger_instance_registry_dir`, via a race condition where after a file was created, there was a window in which it could be replaced with a symlink before it was chowned via the path and not the file descriptor.\nIf the symlink target was to a file which would be executed by root such as root\u0027s crontab file, then privilege escalation was possible.",
"gem": "passenger",
"patched_versions": [
"\u003e= 5.3.2"
],
"title": "CHMOD race vulnerability",
"unaffected_versions": [
"\u003c 3.0.0"
],
"url": "https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=3.0.0 \u003c5.3.2",
"affected_versions": "All versions starting from 3.0.0 before 5.3.2",
"cvss_v2": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-937"
],
"date": "2019-03-08",
"description": "A race condition in the nginx module in Phusion Passenger allows local escalation of privileges when a non-standard `passenger_instance_registry_dir` with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root\u0027s crontab file allows privilege escalation.",
"fixed_versions": [
"5.3.2"
],
"identifier": "CVE-2018-12029",
"identifiers": [
"CVE-2018-12029"
],
"not_impacted": "All versions before 3.0.0, all versions starting from 5.3.2",
"package_slug": "gem/passenger",
"pubdate": "2018-06-17",
"solution": "Upgrade to version 5.3.2 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2018-12029",
"https://blog.phusion.nl/passenger-5-3-2"
],
"uuid": "500a4040-5fea-45c2-bc04-6c02f97617de"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.3.2",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-12029"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root\u0027s crontab file allows privilege escalation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc"
},
{
"name": "https://blog.phusion.nl/passenger-5-3-2",
"refsource": "MISC",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://blog.phusion.nl/passenger-5-3-2"
},
{
"name": "[debian-lts-announce] 20180627 [SECURITY] [DLA 1399-1] ruby-passenger security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html"
},
{
"name": "GLSA-201807-02",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201807-02"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.0,
"impactScore": 5.9
}
},
"lastModifiedDate": "2019-03-08T14:12Z",
"publishedDate": "2018-06-17T20:29Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…