CVE-2021-3917 (published 2022-08-23T20:15Z)

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-276
cwe_name: Incorrect Default Permissions
description: During installation, installed file permissions are set to allow anyone to modify those files.
extended_description: 
      
      
     
     

Fix information:
repo_url: https://github.com/coreos/coreos-installer
commit_details: repo_url: https://github.com/coreos/coreos-installer
author: Benjamin Gilbert
author_date: 2021-07-06 13:07:30-04:00
msg: install: restrict access permissions on /boot/ignition{,/config.ign}

The Ignition config may contain secrets.  Don't expose it, or anything in
its parent directory, to unprivileged processes.

https://github.com/coreos/fedora-coreos-tracker/issues/889
repository: repo_url: https://github.com/coreos/coreos-installer
repo_name: coreos/coreos-installer
description: Installer for CoreOS disk images
repo_language: Rust
owner: coreos
file_changes: filename: install.rs
change_type: ModificationType.MODIFY
diff: @@ -16,9 +16,11 @@ use anyhow::{bail, Context, Result};
 use lazy_static::lazy_static;
 use nix::mount;
 use regex::Regex;
-use std::fs::{copy as fscopy, create_dir_all, read_dir, File, OpenOptions};
+use std::fs::{
+    copy as fscopy, create_dir_all, read_dir, set_permissions, File, OpenOptions, Permissions,
+};
 use std::io::{copy, Read, Seek, SeekFrom, Write};
-use std::os::unix::fs::FileTypeExt;
+use std::os::unix::fs::{FileTypeExt, PermissionsExt};
 use std::path::{Path, PathBuf};
 
 use crate::blockdev::*;
@@ -248,7 +250,21 @@ fn write_ignition(
     // make parent directory
     let mut config_dest = mountpoint.to_path_buf();
     config_dest.push("ignition");
-    create_dir_all(&config_dest).context("creating Ignition config directory")?;
+    if !config_dest.is_dir() {
+        create_dir_all(&config_dest).with_context(|| {
+            format!(
+                "creating Ignition config directory {}",
+                config_dest.display()
+            )
+        })?;
+        // Ignition data may contain secrets; restrict to root
+        set_permissions(&config_dest, Permissions::from_mode(0o700)).with_context(|| {
+            format!(
+                "setting file mode for Ignition directory {}",
+                config_dest.display()
+            )
+        })?;
+    }
 
     // do the copy
     config_dest.push("config.ign");
@@ -262,6 +278,13 @@ fn write_ignition(
                 config_dest.display()
             )
         })?;
+    // Ignition config may contain secrets; restrict to root
+    set_permissions(&config_dest, Permissions::from_mode(0o600)).with_context(|| {
+        format!(
+            "setting file mode for destination Ignition config {}",
+            config_dest.display()
+        )
+    })?;
     copy(&mut config_in, &mut config_out).context("writing Ignition config")?;
 
     Ok(())

programming_language: Rust