SB2019070308 - Multiple vulnerabilities in Calamares

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019070308

SB2019070308 - Multiple vulnerabilities in Calamares

Published: July 3, 2019 Updated: December 5, 2019

Security Bulletin ID SB2019070308
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Incorrect default permissions (CVE-ID: CVE-2019-13179)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect default permissions for files that are copied from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable initramfs image. A local user can decryption keys for LUKS containers created with Full Disk Encryption.


2) Race condition (CVE-ID: CVE-2019-13178)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in modules/luksbootkeyfile/main.py when creating LUKS encryption keyfile. A local user can exploit the race and gain unauthorized access to sensitive information in the encryption file while the application sets permissions on the file.


Remediation

Install update from vendor's website.

References