CVE-2020-24612
Description
It was found that when SELinux works in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with 'nouserok' option, which is the default when configured with the authselect tool, if that file cannot be read, the 2nd factor is disabled. So in such a configuration, an attacker with only the knowledge of the password can log in without the need for the 2nd factor.
Statement
Red Hat Enterprise Linux is not affected by this issue as it does not ship pam-u2f.
In Fedora, updating the package does not trigger a relabeling of the users' pre-existing 2nd factor configuration (including root), and such may need to be manually updated, using the fixfiles onboot command, followed by a reboot (or by applying the mitigation).
Mitigation
To manually permit the read of the config file, the file's SELinux context can be modified :
For example, for a given user '<USER>' :
# chcon -R -t auth_home_t ~<USER>/.config/Yubico
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Acknowledgements
Red Hat would like to thank Dietmar Lippold for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
