ACL Bypass Flaw in pacemaker
Summary
DLA-2447-2: pacemaker - regression update. Affects pacemaker versions < 1.1.16-1+deb9u2. Fixed in 1.1.16-1+deb9u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pacemaker is a cluster resource manager that provides high availability of services in a cluster environment. It manages resources, monitors their status, and ensures their availability. Pacemaker is commonly used in Linux-based clusters to maintain the availability of critical services. However, a vulnerability has been discovered in pacemaker that allows an attacker with local access and membership in the haclient group to bypass access control lists (ACLs) and perform unauthorized tasks through direct IPC communication with various daemons.
Vulnerability Detail
The ACL bypass flaw in pacemaker allows an attacker to circumvent the restrictions imposed by ACLs by using IPC communication with daemons directly. This means that an attacker, with a local account on the cluster and in the haclient group, can perform certain tasks that would otherwise be prevented by ACLs if they were performed through the configuration. This vulnerability can lead to unauthorized access and manipulation of cluster resources, potentially compromising the availability and integrity of critical services.
How To Fix
Minimum fixed version
1.1.16-1+deb9u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pacemakerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to follow the principle of least privilege and restrict access to the cluster and its components only to trusted users. Additionally, regular monitoring and auditing of cluster activities can help detect any unauthorized actions.
Conclusion
The ACL bypass flaw in pacemaker poses a security risk to cluster environments using this resource manager. It is crucial to upgrade to the fixed version of pacemaker to mitigate the vulnerability. Regular monitoring and access control measures should also be implemented to detect and prevent unauthorized actions. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pacemaker →
FAQ
Pacemaker is a cluster resource manager that provides high availability of services in a cluster environment. It manages resources, monitors their status, and ensures their availability.
An ACL bypass flaw allows an attacker to circumvent the restrictions imposed by access control lists (ACLs) and perform unauthorized actions that would otherwise be prevented by the ACLs.
Users of pacemaker on Debian 9 stretch are affected by this vulnerability if they have local accounts on the cluster and are members of the haclient group.
An attacker with local access and membership in the haclient group can use IPC communication with daemons directly to perform certain tasks that would be prevented by ACLs if performed through the configuration. This can lead to unauthorized access and manipulation of cluster resources.
To fix this vulnerability, it is recommended to upgrade the pacemaker packages to version 1.1.16-1+deb9u1 or later. This can be done by updating the package using the package manager of the operating system.
Related vulnerabilities
Recent vulnerabilities recorded for pacemaker.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
