CVE-2018-6552

{"id": "CVE-2018-6552", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2018-05-31T22:29:00.207", "references": [{"url": "https://usn.ubuntu.com/3664-2/", "tags": ["Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "https://usn.ubuntu.com/usn/usn-3664-1", "tags": ["Vendor Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers. The is_same_ns() function returns True when /proc/<global pid>/ does not exist in order to indicate that the crash should be handled in the global namespace rather than inside of a container. However, the portion of the data/apport code that decides whether or not to forward a crash to a container does not always replace sys.argv[1] with the value stored in the host_pid variable when /proc/<global pid>/ does not exist which results in the container pid being used in the global namespace. This flaw affects versions 2.20.8-0ubuntu4 through 2.20.9-0ubuntu7, 2.20.7-0ubuntu3.7, 2.20.7-0ubuntu3.8, 2.20.1-0ubuntu2.15 through 2.20.1-0ubuntu2.17, and 2.14.1-0ubuntu3.28."}, {"lang": "es", "value": "Apport no gestiona adecuadamente los cierres inesperados provenientes de un espacio de nombre PID, lo que permite que los usuarios locales creen ciertos archivos como root. Un atacante podr\u00eda aprovechar estos archivos para realizar una denegaci\u00f3n de servicio (DoS) mediante el agotamiento de recursos o, posiblemente, obtener privilegios root o escapar de contenedores. La funci\u00f3n is_same_ns() devuelve True cuando /proc// no existe para indicar que el cierre inesperado deber\u00eda ser gestionado en el espacio de nombres global, en lugar de en el interior de un contenedor. Sin embargo, la porci\u00f3n de c\u00f3digo de datos/apport que decide si reenviar o no un cierre inesperado a un contenedor no siempre reemplaza sys.argv[1] con el valor almacenado en la variable host_pid cuando /proc// no existe. Esto resulta en que el contenedor pid se emplea en el espacio de nombres global. Este error afecta a las versiones 2.20.8-0ubuntu4 hasta 2.20.9-0ubuntu7, 2.20.7-0ubuntu3.7, 2.20.7-0ubuntu3.8, 2.20.1-0ubuntu2.15 hasta 2.20.1-0ubuntu2.17 y 2.14.1-0ubuntu3.28."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apport_project:apport:2.14.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CBC4B18-529F-4AAE-BCFE-6F8ACA5346B5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "vulnerable": false, "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apport_project:apport:2.20.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01B2C2C2-E12D-4DD2-9162-2ABBE91454BE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "vulnerable": false, "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apport_project:apport:2.20.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF9D13BC-5B99-4B99-9C43-5FA848F9AAAC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apport_project:apport:2.20.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D55EA2A0-01E7-4816-ACBE-497296FAE0D7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "vulnerable": false, "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@ubuntu.com"}