CVE-2017-14483

Gentoo dev-python/flower package allows local users to kill processes through PID file manipulation

• CVSS 5.5
• CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
• Authentication, Authorization, and Session Management
• Local

flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command.

CVE

CVE-2017-14483

CWE

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSS base score

5.5

Published

2017-09-15

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update dev-python/flower package to version 0.9.1-r1 or higher.

import os

def create_pid_file(pid_file_path):
    with open(pid_file_path, 'w') as pid_file:
        pid_file.write(str(os.getpid()))

create_pid_file('/var/run/my_service.pid')

import os
import sys
import stat

def create_pid_file(pid_file_path):
    if os.geteuid() != 0:
        print("This script must be run as root.")
        sys.exit(1)

    with open(pid_file_path, 'w') as pid_file:
        pid_file.write(str(os.getpid()))
    
    os.chown(pid_file_path, 0, 0)
    os.chmod(pid_file_path, stat.S_IRUSR | stat.S_IWUSR)

create_pid_file('/var/run/my_service.pid')

@misc{vaitp:cve201714483,
  title        = {{Gentoo dev-python/flower package allows local users to kill processes through PID file manipulation}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2017-14483},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2017-14483/}}
}