Permissions, Privileges, and Access Controls in gvfs - CVE-2019-12449

Vulnerability identifier: #VU18676

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-12449

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to mishandling of file user and group ownership in the daemon/gvfsbackendadmin.c file. Operations "G_FILE_COPY_ALL_METADATA" from admin:// URIs to file:// URIs during move-and-copy are handled by the Gnome Input/Output (GIO) fallback code, which does not run with root permissions. A remote attacker can gain unauthorized access to arbitrary file information on a system.

gvfs
gnome-remote-desktop (Red Hat package)
accountsservice (Red Hat package)
libvncserver (Red Hat package)
gvfs (Alpine package)
gjs (Red Hat package)
gtk3 (Red Hat package)
gnome-tweaks (Red Hat package)
nautilus (Red Hat package)
gnome-control-center (Red Hat package)
gdm (Red Hat package)
evince (Red Hat package)
gnome-boxes (Red Hat package)
gnome-software (Red Hat package)
gsettings-desktop-schemas (Red Hat package)
gnome-settings-daemon (Red Hat package)
gnome-shell (Red Hat package)
mutter (Red Hat package)
appstream-data (Red Hat package)
mozjs60 (Red Hat package)
LibRaw (Red Hat package)
vala (Red Hat package)
libxslt (Red Hat package)
clutter (Red Hat package)
gvfs
gnome-menus (Red Hat package)
vinagre (Red Hat package)
gnome-session (Red Hat package)
gnome-online-accounts (Red Hat package)
gnome-terminal (Red Hat package)
mozjs52 (Red Hat package)
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora

gvfs - update to -
gnome-remote-desktop (Red Hat package) - update to 0.1.6-8.el8
accountsservice (Red Hat package) - update to 0.6.50-8.el8
libvncserver (Red Hat package) - update to 0.9.11-14.el8
gvfs (Alpine package) - update to 1.34.1-r1
gjs (Red Hat package) - update to 1.56.2-4.el8
gtk3 (Red Hat package) - update to 3.22.30-5.el8
gnome-tweaks (Red Hat package) - update to 3.28.1-7.el8
nautilus (Red Hat package) - update to 3.28.1-12.el8
gnome-control-center (Red Hat package) - update to 3.28.2-19.el8
gdm (Red Hat package) - update to 3.28.3-29.el8
evince (Red Hat package) - update to 3.28.4-4.el8
gnome-boxes (Red Hat package) - update to 3.28.5-8.el8
gnome-software (Red Hat package) - update to 3.30.6-3.el8
gsettings-desktop-schemas (Red Hat package) - update to 3.32.0-4.el8
gnome-settings-daemon (Red Hat package) - update to 3.32.0-9.el8
gnome-shell (Red Hat package) - update to 3.32.2-14.el8
mutter (Red Hat package) - update to 3.32.2-34.el8
appstream-data (Red Hat package) - update to 8-20191129.el8
mozjs60 (Red Hat package) - update to 60.9.0-4.el8
LibRaw (Red Hat package) - update to 0.19.5-1.el8
vala (Red Hat package) - update to 0.40.19-1.el8
libxslt (Red Hat package) - update to 1.1.32-4.el8
clutter (Red Hat package) - update to 1.26.2-8.el8
gvfs - addressed in versions 1.38.3-1.fc29, 1.40.2-1.fc30
gnome-menus (Red Hat package) - update to 3.13.3-11.el8
vinagre (Red Hat package) - update to 3.22.0-21.el8
gnome-session (Red Hat package) - update to 3.28.1-8.el8
gnome-online-accounts (Red Hat package) - update to 3.28.2-1.el8
gnome-terminal (Red Hat package) - update to 3.28.3-1.el8
mozjs52 (Red Hat package) - update to 52.9.0-2.el8

• https://gitlab.gnome.org/GNOME/gvfs/commit/d5dfd823c94045488aef8727c553f1e0f7666b90

• OpenSUSE Linux update for gvfs
• OpenSUSE Linux update for gvfs
• Red Hat Enterprise Linux 8 update for GNOME
• Permissions, Privileges, and Access Controls in gvfs (Alpine package)
• Fedora 30 update for gvfs
• Fedora 29 update for gvfs