Executive brief
instack-undercloud, a tool used to install and manage OpenStack cloud infrastructure, contains a vulnerability in its installation and security policy scripts. A local attacker with low-level access to the system could exploit this flaw to overwrite critical system files. This could lead to a loss of data integrity or unauthorized access to sensitive configuration information.
Technical details
A flaw exists in instack-undercloud (versions up to 7.2.0) where pre-install and security policy scripts utilize hardcoded or predictable temporary file paths in /tmp without proper validation. A local attacker can create a symbolic link at the expected temporary file location pointing to an arbitrary file on the system. When the script runs with higher privileges, it follows the symlink and overwrites the target file. This is classified as CWE-377 (Insecure Temporary File) and CWE-59 (Improper Link Resolution). The vulnerability requires local access and has high complexity due to the race condition timing required for successful exploitation. Red Hat has released patches for affected OpenStack Platform versions.
Affected products
- OpenStack instack-undercloud <= 7.2.0
- Red Hat Red Hat OpenStack Platform 9.0, 10.0, 11.0, 12.0
Timeline
- 2017-08-30: patched: Red Hat released initial security updates (RHSA-2017:2557)
- 2017-09-21: disclosed: NVD publication date
- 2022-05-13: advisory: GitHub Advisory published