Local File Ownership Vulnerability in OpenRC Package
Summary
ALPINE-CVE-2018-21269: checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink. Affects openrc versions < 0.41.2-r2. Fixed in 0.41.2-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenRC is an init system used in Alpine Linux and other distributions, designed to manage system services and dependencies. It provides a simple and efficient way to start, stop, and manage services, making it a vital component for system administrators. However, OpenRC versions prior to 0.42.1 are susceptible to a vulnerability that allows local users to manipulate file ownership through symlink exploitation.
Vulnerability Detail
The vulnerability, identified as ALPINE-CVE-2018-21269, arises from the 'checkpath' function in OpenRC versions up to 0.42.1. This function does not adequately handle symlinks in non-terminal path components, allowing local users to create symlinks that can redirect file operations to arbitrary locations. As a result, a malicious user could gain ownership of sensitive files, potentially leading to unauthorized access or privilege escalation. The CVSS score for this vulnerability is 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.41.2-r2
This is the first release that contains the fix.
sudo apk add --upgrade openrcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected functionality by modifying permissions on the directories where symlinks may be created, or by monitoring file changes to detect unauthorized modifications.
Conclusion
The vulnerability in OpenRC poses a significant risk to local file security, allowing unauthorized users to gain ownership of sensitive files. It is crucial for users to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for openrc →
FAQ
The vulnerability allows local users to take ownership of arbitrary files, which can lead to unauthorized access and potential privilege escalation.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
OpenRC versions prior to 0.42.1 are affected, specifically versions 0.41.2-r2, 0.42.1-r3, 0.42.1-r12, and 0.42.1-r20 in various Alpine Linux releases.
If immediate updates are not possible, consider implementing stricter permissions on directories and monitoring for unauthorized file changes as a temporary measure.
Detailed information can be found in the CVE report for ALPINE-CVE-2018-21269, which outlines the vulnerability's specifics and recommended actions.
References
Related vulnerabilities
Recent vulnerabilities recorded for openrc.
