Bug 738154 (CVE-2020-14367) – <net-misc/chrony-3.5.1: Insecure temp file handling (CVE-2020-14367)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2020-08-20 07:14:00 UTC]

"CVE-2020-14367: Insecure writing of pidfile
-------------------------------------------

When chronyd is configured to save the pidfile in a directory where the
chrony user has write permissions (e.g. /var/run/chrony - the default
since chrony-3.4), an attacker that compromised the chrony user account
could create a symbolic link at the location of the pidfile to make
chronyd starting with root privileges follow the symlink and write its
process ID to a file for which the chrony user doesn't have write
permissions, causing a denial of service, or data loss.

This issue was reported by Matthias Gerstner of SUSE."

Fixed in 3.5.1.

[Comment 1 Larry the Git Cow 2020-08-20 07:31:56 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=151b33bc43ba47d284b0aa711abd7e3b62f31ea4

commit 151b33bc43ba47d284b0aa711abd7e3b62f31ea4
Author:     Jeroen Roovers <[e-mail]>
AuthorDate: 2020-08-20 07:31:33 +0000
Commit:     Jeroen Roovers <[e-mail]>
CommitDate: 2020-08-20 07:31:53 +0000

    net-misc/chrony: Version 3.5.1
    
    Package-Manager: Portage-3.0.4, Repoman-3.0.1
    Bug: https://bugs.gentoo.org/738154
    Signed-off-by: Jeroen Roovers <[e-mail]>

 net-misc/chrony/Manifest            |   1 +
 net-misc/chrony/chrony-3.5.1.ebuild | 172 ++++++++++++++++++++++++++++++++++++
 2 files changed, 173 insertions(+)

[Comment 2 Sam James 2020-08-20 09:02:40 UTC]

Thanks. Tell us when ready to stable.

[Comment 3 Sam James 2020-08-25 23:32:09 UTC]

Any objections to stabling, or we will go ahead?

[Comment 4 NATTkA bot 2020-08-27 10:08:50 UTC]

Unable to check for sanity:

> no match for package: net-misc/chrony-3.5.1

[Comment 5 Thomas Deutschmann (RETIRED) 2020-08-30 17:15:24 UTC]

x86 stable

[Comment 6 Sam James 2020-08-30 20:54:36 UTC]

amd64 done

[Comment 7 GLSAMaker/CVETool Bot 2020-08-30 21:14:52 UTC]

This issue was resolved and addressed in
 GLSA 202008-23 at https://security.gentoo.org/glsa/202008-23
by GLSA coordinator Sam James (sam_c).

[Comment 8 Sam James 2020-08-30 21:15:22 UTC]

Reopening for stable.

[Comment 9 Sam James 2020-08-30 22:51:18 UTC]

ppc64 done

[Comment 10 Sam James 2020-08-30 23:01:19 UTC]

arm done

[Comment 11 Sam James 2020-08-30 23:02:59 UTC]

sparc done

[Comment 12 Sam James 2020-08-30 23:31:24 UTC]

ppc done

[Comment 13 Larry the Git Cow 2020-09-02 15:51:40 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0e1caaf3bc2225e4703cd9c66adf90ba3882836e

commit 0e1caaf3bc2225e4703cd9c66adf90ba3882836e
Author:     Jeroen Roovers <[e-mail]>
AuthorDate: 2020-09-02 15:30:10 +0000
Commit:     Jeroen Roovers <[e-mail]>
CommitDate: 2020-09-02 15:51:37 +0000

    net-misc/chrony: Old
    
    Package-Manager: Portage-3.0.5, Repoman-3.0.1
    Bug: https://bugs.gentoo.org/738154
    Signed-off-by: Jeroen Roovers <[e-mail]>

 net-misc/chrony/Manifest                           |   1 -
 net-misc/chrony/chrony-3.5-r2.ebuild               | 127 ---------------
 net-misc/chrony/chrony-3.5-r4.ebuild               | 172 ---------------------
 .../chrony/files/chrony-3.5-systemd-gentoo.patch   |  12 --
 net-misc/chrony/metadata.xml                       |   1 -
 5 files changed, 313 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=356b6432ed5d3ea159b68b5b6060cd9f9b843b12

commit 356b6432ed5d3ea159b68b5b6060cd9f9b843b12
Author:     Jeroen Roovers <[e-mail]>
AuthorDate: 2020-09-02 15:26:17 +0000
Commit:     Jeroen Roovers <[e-mail]>
CommitDate: 2020-09-02 15:51:36 +0000

    net-misc/chrony: Stable for HPPA
    
    Package-Manager: Portage-3.0.5, Repoman-3.0.1
    Bug: https://bugs.gentoo.org/738154
    Signed-off-by: Jeroen Roovers <[e-mail]>

 net-misc/chrony/chrony-3.5.1-r1.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[Comment 14 John Helmert III 2020-09-02 16:16:08 UTC]

HPPA was last arch. Please cleanup.

[Comment 15 John Helmert III 2020-09-02 16:33:32 UTC]

(In reply to John Helmert III (ajak) from comment #14)
> HPPA was last arch. Please cleanup.

Whoops, cleanup already done, sorry about that. All done.