Incorrect default permissions in logrotate - CVE-2022-1348

Vulnerability identifier: #VU63693

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1348

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to the way logrotate uses the state file. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation.

logrotate
Oracle Linux
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
Ubuntu
openEuler
Fedora
logrotate (Ubuntu package)
logrotate
logrotate (Red Hat package)
logrotate-debuginfo
logrotate-debugsource
logrotate-help
OpenShift Data Foundation (formerly OpenShift Container Storage)

Install updates from vendor's website.

logrotate - update to 3.20.0
logrotate (Ubuntu package) - addressed in versions 3.18.0-2ubuntu1.1, 3.19.0-1ubuntu1.1
logrotate - addressed in versions 3.18.0-4.fc34, 3.18.0-5.fc34, 3.18.1-3.fc35, 3.18.1-4.fc35, 3.20.1-1.fc36
logrotate (Red Hat package) - update to 3.18.0-7.el9
logrotate - update to 3.18.1-150400.3.7.1
logrotate-debuginfo - update to 3.18.1-150400.3.7.1
logrotate-debugsource - update to 3.18.1-150400.3.7.1
logrotate - update to 3.20.1-1
logrotate-debuginfo - update to 3.20.1-1
logrotate-debugsource - update to 3.20.1-1
logrotate-help - update to 3.20.1-1
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-1348
• http://www.openwall.com/lists/oss-security/2022/05/25/3
• http://www.openwall.com/lists/oss-security/2022/05/25/4

• Denial of service in logrotate
• Ubuntu update for logrotate
• SUSE update for logrotate
• Red Hat Enterprise Linux 9 update for logrotate
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in Oracle Linux
• openEuler 22.03 LTS update for logrotate
• Fedora 34 update for logrotate
• Fedora 36 update for logrotate
• Fedora 35 update for logrotate
• Fedora 34 update for logrotate
• Fedora 35 update for logrotate