ClusterLabs/PCS: [CVE-2022-2735] Obtaining an authentication token for hacluster user leads to privilege escalation.

[Tej Rathi <trathi () redhat com>]

Hello,

A security issue was discovered in the ClusterLabs/PCS project. This is
CVE-2022-2735, assigned by Red Hat.
(https://github.com/ClusterLabs/pcs)


*ROOT CAUSE & IMPACT:*
*------------------------------------*

It is caused by incorrect permissions on a unix socket used for internal
communication between pcs daemons. Reproducer below demonstrates a
privilege escalation by obtaining authentication token for hacluster
user. With the hacluster token, an attacker has complete control over
the cluster managed by pcs.

CVSS Base Score [HIGH]: 8.4/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H


*AFFECTED VERSIONS:*

*---------------------------------*

pcs upstream is affected since version 0.10.5 [1][2]. This means that all
0.10.x versions starting from 0.10.5 including the latest 0.10 branch
release 0.10.14 are affected. And all 0.11.x versions are affected as well.

POC and PATCH are in the attachment.


*CREDITS:*

*--------------*

The issue was discovered by Ondrej Mular (Senior Software Engineer, Red Hat)


*REFERENCES:*
*---------------------*

[1]: https://github.com/ClusterLabs/pcs/releases/tag/0.10.5
[2]:
https://github.com/ClusterLabs/pcs/blob/main/CHANGELOG.md#0105---2020-03-18


- - - - - - - - - - - - - - - -

Thanks & Regards,

TEJ RATHI

Associate Product Security Engineer | PSIRT

Product Security Engineering, Red Hat.

Attachment: patch
Description:

Attachment: poc
Description: