#VU23408 Race condition in Calamares - CVE-2019-13178
Published: December 5, 2019
Vulnerability identifier: #VU23408
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-13178
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Calamares
Calamares
Software vendor:
Calamares
Calamares
Description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition in modules/luksbootkeyfile/main.py when creating LUKS encryption keyfile. A local user can exploit the race and gain unauthorized access to sensitive information in the encryption file while the application sets permissions on the file.
Remediation
Install updates from vendor's website.
External links
- https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095
- https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096
- https://bugzilla.redhat.com/show_bug.cgi?id=1726565
- https://calamares.io/calamares-3.2.11-is-out/
- https://calamares.io/calamares-cve-2019/
- https://github.com/calamares/calamares/issues/1190
- https://github.com/calamares/calamares/issues/1191
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q57BOTBA2J5U4GVKUP7N2PD5H7B3BVUU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R2ZDQRGBGRVRW5LPJWKUNS3M66LZ3KYC/
- https://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/
- https://www.pavelkogan.com/2015/01/25/linux-mint-encryption/