gsd-2018-12029
Vulnerability from gsd
Modified
2018-06-12 00:00
Details
The file system access race condition allows for local privilege escalation and affects the Nginx module for Passenger versions 5.3.1, all the way back to 3.0.0 (the chown command entered the code in 2010).
The vulnerability was exploitable only when running a non-standard `passenger_instance_registry_dir`, via a race condition where after a file was created, there was a window in which it could be replaced with a symlink before it was chowned via the path and not the file descriptor.
If the symlink target was to a file which would be executed by root such as root's crontab file, then privilege escalation was possible.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2018-12029",
"description": "A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root\u0027s crontab file allows privilege escalation.",
"id": "GSD-2018-12029",
"references": [
"https://www.suse.com/security/cve/CVE-2018-12029.html",
"https://ubuntu.com/security/CVE-2018-12029"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "passenger",
"purl": "pkg:gem/passenger"
}
}
],
"aliases": [
"CVE-2018-12029"
],
"details": "The file system access race condition allows for local privilege escalation and affects the Nginx module for Passenger versions 5.3.1, all the way back to 3.0.0 (the chown command entered the code in 2010).\nThe vulnerability was exploitable only when running a non-standard `passenger_instance_registry_dir`, via a race condition where after a file was created, there was a window in which it could be replaced with a symlink before it was chowned via the path and not the file descriptor.\nIf the symlink target was to a file which would be executed by root such as root\u0027s crontab file, then privilege escalation was possible.",
"id": "GSD-2018-12029",
"modified": "2018-06-12T00:00:00.000Z",
"published": "2018-06-12T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": 4.4,
"type": "CVSS_V2"
},
{
"score": 7.0,
"type": "CVSS_V3"
}
],
"summary": "CHMOD race vulnerability"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-12029",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root\u0027s crontab file allows privilege escalation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://blog.phusion.nl/passenger-5-3-2",
"refsource": "MISC",
"url": "https://blog.phusion.nl/passenger-5-3-2"
},
{
"name": "GLSA-201807-02",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201807-02"
},
{
"name": "https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc",
"refsource": "MISC",
"url": "https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc"
},
{
"name": "[debian-lts-announce] 20180627 [SECURITY] [DLA 1399-1] ruby-passenger security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html"
}
]
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2018-12029",
"cvss_v2": 4.4,
"cvss_v3": 7.0,
"date": "2018-06-12",
"description": "The file system access race condition allows for local privilege escalation and affects the Nginx module for Passenger versions 5.3.1, all the way back to 3.0.0 (the chown command entered the code in 2010).\nThe vulnerability was exploitable only when running a non-standard `passenger_instance_registry_dir`, via a race condition where after a file was created, there was a window in which it could be replaced with a symlink before it was chowned via the path and not the file descriptor.\nIf the symlink target was to a file which would be executed by root such as root\u0027s crontab file, then privilege escalation was possible.",
"gem": "passenger",
"patched_versions": [
"\u003e= 5.3.2"
],
"title": "CHMOD race vulnerability",
"unaffected_versions": [
"\u003c 3.0.0"
],
"url": "https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=3.0.0 \u003c5.3.2",
"affected_versions": "All versions starting from 3.0.0 before 5.3.2",
"cvss_v2": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-937"
],
"date": "2019-03-08",
"description": "A race condition in the nginx module in Phusion Passenger allows local escalation of privileges when a non-standard `passenger_instance_registry_dir` with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root\u0027s crontab file allows privilege escalation.",
"fixed_versions": [
"5.3.2"
],
"identifier": "CVE-2018-12029",
"identifiers": [
"CVE-2018-12029"
],
"not_impacted": "All versions before 3.0.0, all versions starting from 5.3.2",
"package_slug": "gem/passenger",
"pubdate": "2018-06-17",
"solution": "Upgrade to version 5.3.2 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2018-12029",
"https://blog.phusion.nl/passenger-5-3-2"
],
"uuid": "500a4040-5fea-45c2-bc04-6c02f97617de"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.3.2",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-12029"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root\u0027s crontab file allows privilege escalation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc"
},
{
"name": "https://blog.phusion.nl/passenger-5-3-2",
"refsource": "MISC",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://blog.phusion.nl/passenger-5-3-2"
},
{
"name": "[debian-lts-announce] 20180627 [SECURITY] [DLA 1399-1] ruby-passenger security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html"
},
{
"name": "GLSA-201807-02",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201807-02"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.0,
"impactScore": 5.9
}
},
"lastModifiedDate": "2019-03-08T14:12Z",
"publishedDate": "2018-06-17T20:29Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…