PT-2020-15765 · Selinux · Selinux-Policy

Published 2020-08-24 · Updated 2022-05-11 · CVE-2020-24612

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AC:H/AV:L/A:N/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions selinux-policy versions 3.14 through 2020-08-24

Description An issue in the selinux-policy package causes the .config/Yubico directory to be mishandled. As a result, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option and the file cannot be read, the second factor is disabled, allowing an attacker with only password knowledge to log in and bypass 2FA.

Recommendations For selinux-policy versions 3.14 through 2020-08-24, consider updating the selinux-policy package to a version that properly handles the .config/Yubico directory, ensuring pam-u2f can read the U2F configuration file and 2FA functions as intended.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-24612

OESA-2022-1646

Affected Products

Selinux-Policy

References · 9

• https://github.com/fedora-selinux/selinux-policy/commit/71e1989028802c7875d3436fd3966c587fa383fb · Patch
• https://cve.org/CVERecord?id=CVE-2020-24612 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1646 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24612 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-24612 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24612 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1860888 · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1646 · Note