CVE-2019-10143 Privilege escalation in freeradius

Medium 6.4 Published 24 May 2019 Updated 4 Aug 2024

A local attacker with radiusd user access can escalate privileges to root by exploiting a logrotate misconfiguration in FreeRADIUS.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2019-10143?

CVE-2019-10143 is a medium-severity vulnerability in Fedoraproject Fedora, published on 24 May 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."

Weakness: CWE-362, CWE-266, CWE-250

Which versions are affected by CVE-2019-10143?

It affects 3 products.

Linux distribution packages (23)

`freeradius` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-devel` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-doc` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-krb5` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-krb5-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-ldap` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-ldap-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-mysql` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-mysql-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-perl` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-perl-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-postgresql` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-postgresql-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-rest` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-rest-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-sqlite` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-sqlite-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-unixODBC` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-unixODBC-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-utils` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`
`freeradius-utils-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:3.0.17-6.module+el8.1.0+3392+9bd8939b`

Products include Fedoraproject Fedora, Freeradius Freeradius, Redhat Enterprise Linux.

How do I fix CVE-2019-10143?

Apply the vendor's patch.

Is CVE-2019-10143 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-10143 exists.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALPINE-CVE-2019-10143, DEBIAN-CVE-2019-10143, GHSA-5x22-w79m-34gq, RHSA-2019:3353, UBUNTU-CVE-2019-10143.