Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia 8 MGASA-2022-0217 Critical: Logrotate Permissions Lock Issue

mageia
Calendar Grey June 3, 2022
Dist Mageia Esm H88
A significant vulnerability in logrotate allows non-privileged users to secure the state file, thereby interrupting functionalities. The remedy is substantial.
A vulnerability was found in logrotate in how the state file is created

Summary

A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0. (CVE-2022-1348) Note the change in permission does not apply until the first time logrotate runs after installing the update.

References

- https://bugs.mageia.org/show_bug.cgi?id=30473

- https://www.openwall.com/lists/oss-security/2022/05/25/3

- https://www.openwall.com/lists/oss-security/2022/05/25/5

- https://ubuntu.com/security/notices/USN-5447-1

- https://www.cve.org/CVERecord?id=CVE-2022-1348

Topics%20covered

Topics Covered

security advisory critical issue permissions issue logrotate Mageia

Resolution

SRPMS

- 8/core/logrotate-3.17.0-3.1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 03 Jun 2022
URL: https://advisories.mageia.org/MGASA-2022-0217.html
Type: security
CVE: CVE-2022-1348

Topics%20covered

Topics Covered

security advisory critical issue permissions issue logrotate Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here