Privilege escalation in Red Hat Virtualization Host and Red Hat Virtualization - CVE-2018-10874

Vulnerability identifier: #VU14157

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2018-10874

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to the system reads the 'ansible.cfg' file from the current working directory when running an ad-hoc command. A local attacker can modify the file to reference arbitrary plugin or module paths and execute arbitrary code from those paths with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Red Hat Virtualization Host
Red Hat Virtualization
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Proxy Module
SUSE Manager Client Tools Beta for SLE Micro
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro
Fedora
SUSE Linux Enterprise Server for SAP Applications
SUSE Manager Client Tools Beta for SLE
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Package Hub 15
openSUSE Leap
Red Hat Ansible Engine
Red Hat OpenStack
mgrctl-zsh-completion
mgrctl
mgrctl-bash-completion
POS_Image-Graphical7
POS_Image-JeOS7
dracut-saltboot
golang-github-prometheus-promu
ansible-role-redhat-subscription (Red Hat package)
golang-github-prometheus-node_exporter
ansible (Red Hat package)
ansible
ansible-doc
ansible-test
python3-spacewalk-koan
spacewalk-koan
mgr-daemon
python3-uyuni-common-libs
uyuni-proxy-systemd-services
spacewalk-client-tools
spacewalk-check
python3-spacewalk-client-tools
python3-spacewalk-check
spacewalk-client-setup
python3-spacewalk-client-setup
spacecmd
supportutils-plugin-susemanager-client
grafana
grafana-debuginfo
Ansible

Install update from vendor's website.

Red Hat OpenStack - update to 12
mgrctl-zsh-completion - update to 0.1.7-159000.3.8.1
mgrctl - update to 0.1.7-159000.3.8.1
mgrctl-bash-completion - update to 0.1.7-159000.3.8.1
POS_Image-Graphical7 - addressed in versions 0.1.1710765237.46af599-150000.1.21.2, 0.1.1710765237.46af599-159000.3.24.2
POS_Image-JeOS7 - addressed in versions 0.1.1710765237.46af599-150000.1.21.2, 0.1.1710765237.46af599-159000.3.24.2
dracut-saltboot - addressed in versions 0.1.1710765237.46af599-150000.1.53.2, 0.1.1710765237.46af599-159000.3.33.2
golang-github-prometheus-promu - update to 0.14.0-150000.3.18.2
ansible-role-redhat-subscription (Red Hat package) - update to 1.0.1-4.el7ost
golang-github-prometheus-node_exporter - update to 1.5.0-159000.6.2.1
ansible (Red Hat package) - update to 2.4.6.0-1.el7ae
Ansible - addressed in versions 2.5.6-1.el7ae, 2.6.1-1.el7ae
ansible - addressed in versions 2.6.1-1.el7, 2.6.1-1.fc27, 2.6.1-1.fc28
ansible-doc - addressed in versions 2.9.27-150000.1.17.2, 2.9.27-159000.3.12.2
ansible-test - update to 2.9.27-150000.1.17.2
ansible - addressed in versions 2.9.27-150000.1.17.2, 2.9.27-159000.3.12.2
python3-spacewalk-koan - update to 4.3.6-150000.3.33.2
spacewalk-koan - update to 4.3.6-150000.3.33.2
mgr-daemon - update to 4.3.9-150000.1.47.2
python3-uyuni-common-libs - update to 4.3.10-150000.1.39.2
uyuni-proxy-systemd-services - update to 4.3.12-150000.1.21.2
spacewalk-client-tools - addressed in versions 4.3.19-150000.3.89.2, 5.0.4-159000.6.54.2
spacewalk-check - addressed in versions 4.3.19-150000.3.89.2, 5.0.4-159000.6.54.2
python3-spacewalk-client-tools - addressed in versions 4.3.19-150000.3.89.2, 5.0.4-159000.6.54.2
python3-spacewalk-check - addressed in versions 4.3.19-150000.3.89.2, 5.0.4-159000.6.54.2
spacewalk-client-setup - addressed in versions 4.3.19-150000.3.89.2, 5.0.4-159000.6.54.2
python3-spacewalk-client-setup - addressed in versions 4.3.19-150000.3.89.2, 5.0.4-159000.6.54.2
spacecmd - addressed in versions 4.3.27-150000.3.116.2, 5.0.5-159000.6.48.2
supportutils-plugin-susemanager-client - update to 5.0.3-159000.6.21.2
grafana - addressed in versions 9.5.16-159000.4.30.2, 9.5.18-150000.1.63.2
grafana-debuginfo - addressed in versions 9.5.16-159000.4.30.2, 9.5.18-150000.1.63.2

• https://access.redhat.com/errata/RHSA-2018:2321

• Privilege escalation vulnerabilities in Red Hat Enterprise Virtualization
• Privilege escalation vulnerabilities in Red Hat Enterprise Virtualization
• Red Hat update for ansible
• Red Hat update for ansible
• Ansible Engine 2.5 update for ansible
• Ansible Engine 2 update for ansible
• Ansible Engine 2.6 update for ansible
• SUSE update for Security Beta update for SUSE Manager Client Tools and Salt
• SUSE update for SUSE Manager Client Tools
• Fedora 27 update for ansible
• Fedora EPEL 7 update for ansible
• Fedora 28 update for ansible
• Multiple vulnerabilities in Red Hat OpenStack packages