Executive Summary

This vulnerability exists in the ansible.posix authorized_key module, specifically in its keyfile() function. The function improperly uses os.chown() instead of os.lchown() and opens files without the O_NOFOLLOW flag, which means it does not safely handle symbolic links.

An unprivileged local user can create symbolic links in their ~/.ssh directory that point to arbitrary system files or directories. When a privileged operator runs the authorized_key task as root, the module follows these symbolic links and changes ownership of the linked files or directories to the unprivileged user. This behavior allows the unprivileged user to escalate their privileges locally.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to local privilege escalation, meaning an unprivileged user on the system could gain higher privileges, potentially root-level access.

This can compromise system security by allowing unauthorized access to sensitive files or system functions, potentially leading to further exploitation or system compromise.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the ansible.posix authorized_key module improperly handling symbolic links in the ~/.ssh directory when run as root. Detection involves checking for the presence of symbolic links in users' ~/.ssh directories that could be exploited.

• Use the command `find ~/.ssh -type l` to identify symbolic links in the SSH directory.
• Audit Ansible playbooks or tasks that use the authorized_key module to see if they are run with elevated privileges.
• Check file ownership changes in sensitive system paths that could indicate exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, avoid running the ansible.posix authorized_key module as root on systems where unprivileged users can create symbolic links in their ~/.ssh directories.

Ensure that the authorized_key module is updated to a version that fixes the issue by using os.lchown() and opening files with O_NOFOLLOW to prevent following symbolic links.

As a temporary workaround, remove or restrict symbolic links in users' ~/.ssh directories to prevent exploitation.

Audit and monitor file ownership changes on critical system paths to detect any unauthorized modifications.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this local privilege escalation vulnerability in the ansible.posix authorized_key module impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0