SB2021012619 - Gentoo update for FreeRADIUS

Description

This security bulletin contains information about 1 vulnerability.

1) UNIX Hard Link (CVE-ID: N/A)

CWE-ID: CWE-62 - UNIX Hard Link

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists in the way FreeRadius is being started on the system. The systemd service file for freeradius runs "chown -R" on a directory before it starts:

  ExecStartPre=-/bin/chown -R radius.radius /run/radiusd

That can be exploited by the "radius" user to gain root privileges. After the service has been started once, the radius user can place a hard link to a root-owned file in /run/radiusd. If the service is later restarted, then the "chown -R" command will give away ownership of that root-owned file to the "radius" user.

As a result, a local user can execute arbitrary code on the system as root.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/
• https://security.gentoo.org/glsa/202101-27