CVE-2021-44225 Missing authorization in n/a

Medium 5.4 Published 26 Nov 2021 Updated 4 Aug 2024

An attacker can bypass D-Bus access controls in Keepalived to inspect and manipulate system properties, potentially affecting other services.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-44225?

CVE-2021-44225 is a medium-severity missing authorization vulnerability in Fedoraproject Fedora, published on 26 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property

Which versions are affected by CVE-2021-44225?

It affects 2 products.

Linux distribution packages (17)

`keepalived` AlmaLinux:8	All versions	`2.1.5-8.el8`
`keepalived` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.1.5-8.el8`
`keepalived-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.1.5-8.el8`
`keepalived-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.1.5-8.el8`
`keepalived` Rocky Linux:8	All versions	`0:2.1.5-8.el8`
`keepalived` SUSE:HPE Helion OpenStack 8	All versions	`2.0.19-3.9.1`
`keepalived` SUSE:Linux Enterprise High Availability Extension 15 SP1	All versions	`2.0.19-150100.3.6.1`
`keepalived` SUSE:Linux Enterprise High Availability Extension 15 SP2	All versions	`2.0.19-150100.3.6.1`
`keepalived` SUSE:Linux Enterprise High Availability Extension 15 SP3	All versions	`2.0.19-150100.3.6.1`
`keepalived` SUSE:Linux Enterprise High Availability Extension 15 SP4	All versions	`2.2.2-150400.3.5.1`
`keepalived` SUSE:OpenStack Cloud 8	All versions	`2.0.19-3.9.1`
`keepalived` SUSE:OpenStack Cloud 9	All versions	`2.0.19-3.6.1`
`keepalived` SUSE:OpenStack Cloud Crowbar 8	All versions	`2.0.19-3.9.1`
`keepalived` SUSE:OpenStack Cloud Crowbar 9	All versions	`2.0.19-3.6.1`
`keepalived` openSUSE:Leap 15.3	All versions	`2.0.19-150100.3.6.1`
`keepalived` openSUSE:Leap 15.4	All versions	`2.2.2-150400.3.5.1`
`keepalived` openSUSE:Tumbleweed	All versions	`2.2.7-1.1`

Products include Fedoraproject Fedora, Keepalived Keepalived.

How do I fix CVE-2021-44225?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-44225 being exploited?

There is no known exploitation of CVE-2021-44225 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALSA-2022:1930, AZL-6508, DEBIAN-CVE-2021-44225, DLA-3388-1, GHSA-jpw2-cwxg-4qv8, MGASA-2021-0567 and 10 more.