Security restrictions bypass in libcgroup - CVE-2018-14348

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU14266

Security restrictions bypass in libcgroup - CVE-2018-14348

Published: August 8, 2018


Vulnerability identifier: #VU14266
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-14348
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to permission within /var/log/cgred were not restrictive enough beforehand and ignored any umask setting. A remote attacker can bypass security restrictions and conduct further attacks.

Affected software

libcgroup
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Fedora
Opensuse
libcgroup
PowerStore T
Dell EMC PowerStore Family Operating System
Data Computing Appliance (DCA)

How to mitigate CVE-2018-14348

Install update from vendor's website.

libcgroup - update to 0.41-20.fc28
PowerStore T - update to 3.6.1.2-2315284
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
Data Computing Appliance (DCA) - update to 4.3.0.0

External References

Related Security Bulletins