Summary
Ken Gaillot discovered that Pacemaker incorrectly handled IPC
communications permissions. A local attacker could possibly use this issue
to bypass ACL restrictions and execute arbitrary code as root.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | pacemaker | 1.1.14-2ubuntu1.9 |
| Ubuntu · 18.04 LTS 18.04:LTS | pacemaker | 1.1.18-0ubuntu1.3 |
| Ubuntu · 20.04 LTS 20.04:LTS | pacemaker | 2.0.3-3ubuntu4.1 |
Vulnerabilities 1
-
Unscored —
An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group …
References
-
report
https://ubuntu.com/security/CVE-2020-25654