mock: CVE-2016-6299: privilige escalation via mock-scm

Debian Bug report logs - #850320
mock: CVE-2016-6299: privilige escalation via mock-scm

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: mock: CVE-2016-6299: privilige escalation via mock-scm

Date: Thu, 05 Jan 2017 21:59:29 +0100

Source: mock
Version: 1.3.2-1
Severity: grave
Tags: patch security upstream
Justification: user security hole

Hi,

the following vulnerability was published for mock. I'm not too
familiar with it, but following the code and the applied upstream
commit 1.3.2-1 should be vulnerable.

CVE-2016-6299[0]:
privilige escalation via mock-scm

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-6299
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6299
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1375490
[2] https://github.com/rpm-software-management/mock/commit/8b02f43beadacf6911200b48d94e39e891a41da9

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 850320@bugs.debian.org (full text, mbox, reply):

From: Tzafrir Cohen <tzafrir@cohens.org.il>

To: Salvatore Bonaccorso <carnil@debian.org>, 850320@bugs.debian.org

Subject: Re: Bug#850320: mock: CVE-2016-6299: privilige escalation via mock-scm

Date: Fri, 6 Jan 2017 00:25:07 +0100

My initial reading into this: neither the version in Stable (1.1.33-1)
nor the version in Testing / Unstable (1.3.2-1) is volnurable. Not
closing yet as I want to test this better.

The version in Jessie-backports seems to be the only one affected by it.

Impact: mock is a chroot building serer. You feed it with RPM source
packages and they get built in chroots (that it creates). Package
specifications may generally include various forms of executable code.
The builder runs the builds as a non-root user. The issue was that the
rpm spec file was evaluated accidentally as root.

This issue was fixed upstream just before 1.2.22, and that fix is
included in the current version (1.3.2). In 1.1.33 the parsing seems to
be done before after temporarily dropping super-user privileges at
startup.

-- 
Tzafrir Cohen         | tzafrir@jabber.org | VIM is
http://tzafrir.org.il |                    | a Mutt's
tzafrir@cohens.org.il |                    |  best
tzafrir@debian.org    |                    | friend

Message #15 received at 850320@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Tzafrir Cohen <tzafrir@cohens.org.il>

Cc: 850320@bugs.debian.org

Subject: Re: Bug#850320: mock: CVE-2016-6299: privilige escalation via mock-scm

Date: Fri, 6 Jan 2017 06:34:15 +0100

# not found actually in 1.3.2 ...
Control: notfound -1 850320 1.3.2-1
# but found in version as in jessie packports according to analysis
Control: found -1 1.2.3-1
# and mark as fixed in 1.3.2-1 the first version after 1.2.21 in the
# archive
Control: fixed -1 850320 1.3.2-1

Hi Tzafrir,

On Fri, Jan 06, 2017 at 12:25:07AM +0100, Tzafrir Cohen wrote:
> My initial reading into this: neither the version in Stable (1.1.33-1)
> nor the version in Testing / Unstable (1.3.2-1) is volnurable. Not
> closing yet as I want to test this better.
> 
> The version in Jessie-backports seems to be the only one affected by it.
> 
> Impact: mock is a chroot building serer. You feed it with RPM source
> packages and they get built in chroots (that it creates). Package
> specifications may generally include various forms of executable code.
> The builder runs the builds as a non-root user. The issue was that the
> rpm spec file was evaluated accidentally as root.
> 
> This issue was fixed upstream just before 1.2.22, and that fix is
> included in the current version (1.3.2). In 1.1.33 the parsing seems to
> be done before after temporarily dropping super-user privileges at
> startup.

Thanks for your investigation and the explanation of the attack
vector, that's much appreciated.

I seem to have read the patch wrongly, leading me to think that
src:mock 1.3.2 is affected. If you agree on the above Control changes
and we are sure that the version in stable is not affected, then I
guess we can go ahead with the closure.

Regards and thanks for your time taken,
Salvatore

Message #26 received at 850320@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 850320@bugs.debian.org

Cc: Tzafrir Cohen <tzafrir@cohens.org.il>

Subject: Re: Bug#850320: mock: CVE-2016-6299: privilige escalation via mock-scm

Date: Fri, 6 Jan 2017 06:52:40 +0100

On Fri, Jan 06, 2017 at 06:34:15AM +0100, Salvatore Bonaccorso wrote:
> # not found actually in 1.3.2 ...
> Control: notfound -1 850320 1.3.2-1
> # but found in version as in jessie packports according to analysis
> Control: found -1 1.2.3-1
> # and mark as fixed in 1.3.2-1 the first version after 1.2.21 in the
> # archive
> Control: fixed -1 850320 1.3.2-1

Bah so much wrong syntax in few lines. I fixed now.

Regards,
Salvatore

Message #31 received at 850320@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: Tzafrir Cohen <tzafrir@cohens.org.il>, 850320@bugs.debian.org

Cc: Salvatore Bonaccorso <carnil@debian.org>

Subject: Re: Bug#850320: mock: CVE-2016-6299: privilige escalation via mock-scm

Date: Fri, 6 Jan 2017 13:37:58 +0000

[Message part 1 (text/plain, inline)]

Hi Tzafrir,

On Fri, Jan 06, 2017 at 12:25:07AM +0100, Tzafrir Cohen wrote:
> The version in Jessie-backports seems to be the only one affected by it.

will you upload a fixed version to jessie-bpo or should I? (I'd be happy
if you did, but I was the person introducing mock to bpo, so I'd take
responsibility and fix, if needed.)


-- 
cheers,
	Holger

[signature.asc (application/pgp-signature, inline)]

Message #36 received at 850320@bugs.debian.org (full text, mbox, reply):

From: Tzafrir Cohen <tzafrir@cohens.org.il>

To: Holger Levsen <holger@layer-acht.org>

Cc: 850320@bugs.debian.org, Salvatore Bonaccorso <carnil@debian.org>

Subject: Re: Bug#850320: mock: CVE-2016-6299: privilige escalation via mock-scm

Date: Sat, 7 Jan 2017 22:28:01 +0100

On Fri, Jan 06, 2017 at 01:37:58PM +0000, Holger Levsen wrote:
> Hi Tzafrir,
> 
> On Fri, Jan 06, 2017 at 12:25:07AM +0100, Tzafrir Cohen wrote:
> > The version in Jessie-backports seems to be the only one affected by it.
> 
> will you upload a fixed version to jessie-bpo or should I? (I'd be happy
> if you did, but I was the person introducing mock to bpo, so I'd take
> responsibility and fix, if needed.)

I prepared a version in the branch jessie-backports in git[1].

It seems to work OK here. I don't hae my key in the backports keyring,
so I prefer that you upload it.


-- 
Tzafrir Cohen         | tzafrir@jabber.org | VIM is
http://tzafrir.org.il |                    | a Mutt's
tzafrir@cohens.org.il |                    |  best
tzafrir@debian.org    |                    | friend

Message #41 received at 850320@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: Tzafrir Cohen <tzafrir@cohens.org.il>

Cc: 850320@bugs.debian.org, Salvatore Bonaccorso <carnil@debian.org>

Subject: Re: Bug#850320: mock: CVE-2016-6299: privilige escalation via mock-scm

Date: Sun, 8 Jan 2017 13:03:07 +0000

[Message part 1 (text/plain, inline)]

Hi Tzafrir,

On Sat, Jan 07, 2017 at 10:28:01PM +0100, Tzafrir Cohen wrote:
> I prepared a version in the branch jessie-backports in git[1].
> 
> It seems to work OK here. I don't hae my key in the backports keyring,
> so I prefer that you upload it.

done, thanks! Also created a git tag and pushed it.

Feel free to ping me for future uploads of mock to jessie-backports. I'm
also subscribed to the package in the PTS…


-- 
cheers,
	Holger

[signature.asc (application/pgp-signature, inline)]

Message #46 received at 850320-done@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: 850320-done@bugs.debian.org

Subject: done

Date: Sun, 10 Feb 2019 17:25:15 +0000

[Message part 1 (text/plain, inline)]

version: 1.3.2-1

long fixed, just never marked as done.


-- 
tschau,
	Holger

-------------------------------------------------------------------------------
               holger@(debian|reproducible-builds|layer-acht).org
       PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.