CVE-2024-39934 (published 2024-07-04T19:15Z)

Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotree usage" feature allows any user to edit any Python environment.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/elabit/robotmk
commit_details: repo_url: https://github.com/elabit/robotmk
author: Solomon Jacobs
author_date: 2024-06-13 09:41:06+02:00
msg: don't enable shared holotrees

CMK-17546
repository: repo_url: https://github.com/elabit/robotmk
repo_name: elabit/robotmk
description: Robotmk - the Robot Framework integration for Checkmk
repo_language: Rust
owner: elabit
file_changes: filename: rcc.rs
change_type: ModificationType.MODIFY
diff: @@ -155,17 +155,6 @@ fn rcc_setup(
         );
     }
 
-    debug!("Initializing shared holotree");
-    (sucessful_plans, rcc_setup_failures.shared_holotree) =
-        shared_holotree_init(global_config, sucessful_plans)
-            .context("Received termination signal while initializing shared holotree")?;
-    if !rcc_setup_failures.shared_holotree.is_empty() {
-        error!(
-            "Dropping the following plans due to shared holotree initialization failure: {}",
-            failed_plan_ids_human_readable(rcc_setup_failures.shared_holotree.keys())
-        );
-    }
-
     debug!("Initializing holotree");
     (sucessful_plans, rcc_setup_failures.holotree_init) =
         holotree_init(global_config, sucessful_plans)
@@ -271,21 +260,6 @@ fn enable_long_path_support(
     )
 }
 
-fn shared_holotree_init(
-    global_config: &GlobalConfig,
-    plans: Vec<Plan>,
-) -> Result<(Vec<Plan>, HashMap<String, String>), Cancelled> {
-    let mut command_spec =
-        RCCEnvironment::bundled_command_spec(&global_config.rcc_config.binary_path);
-    command_spec.add_arguments(["holotree", "shared", "--enable", "--once"]);
-    run_command_spec_once_in_current_session(
-        global_config,
-        plans,
-        &command_spec,
-        "shared_holotree_init",
-    )
-}
-
 fn holotree_init(
     global_config: &GlobalConfig,
     plans: Vec<Plan>,

programming_language: Rust
filename: results.rs
change_type: ModificationType.MODIFY
diff: @@ -40,7 +40,6 @@ pub struct RCCSetupFailures {
     pub telemetry_disabling: HashMap<String, String>,
     pub profile_configuring: HashMap<String, String>,
     pub long_path_support: HashMap<String, String>,
-    pub shared_holotree: HashMap<String, String>,
     pub holotree_init: HashMap<String, String>,
 }
 

programming_language: Rust
filename: test_scheduler.rs
change_type: ModificationType.MODIFY
diff: @@ -234,8 +234,6 @@ async fn assert_working_directory(
             &format!("holotree_initialization_user_{headed_user_name}.stdout"),
             "long_path_support_enabling.stderr",
             "long_path_support_enabling.stdout",
-            "shared_holotree_init.stderr",
-            "shared_holotree_init.stdout",
             "telemetry_disabling_current_user.stderr",
             "telemetry_disabling_current_user.stdout",
             &format!("telemetry_disabling_user_{headed_user_name}.bat"),
@@ -329,8 +327,6 @@ async fn assert_rcc_configuration(rcc_config: &RCCConfig) -> AnyhowResult<()> {
         .arg("diagnostics");
     let stdout = String::from_utf8(rcc_config_diag_command.output().await?.stdout)?;
     assert!(stdout.contains("telemetry-enabled                     ...  \"false\""));
-    assert!(stdout.contains("holotree-shared                       ...  \"true\""));
-    assert!(stdout.contains("holotree-global-shared                ...  \"true\""));
     if let RCCProfileConfig::Custom(custom_rcc_profile_config) = &rcc_config.profile_config {
         assert!(stdout.contains(&format!(
             "config-active-profile                 ...  \"{}\"",

programming_language: Rust