Re: about CVE-2020-14367
Miroslav Lichvar <[email protected]>
| Newsgroups | gmane.comp.time.chrony.user |
|---|---|
| Message-ID | <Yp3MNRV/Y9DMxd/Z@localhost> |
On Mon, Jun 06, 2022 at 09:04:46AM +0000, chengyechun wrote: > All， > > I'm using chrony version 4.1 on an embedded Linux system and I found something about CVE-2020-14367：if some user with privileged to change the chronyd.pid file, like echo another pid > chronyd.pid, and then we cann’t use the command “chronyd” to start chronyd service; This is because the checkpid function checks whether a valid pid exists in the pid file. However, if the pid value in the chrony.pid file is not that of the chronyd service, the denial of service will occur. Only root (or equivalent) and the chrony user should be able to create or modify the pidfile. Those users can do whatever they like with chronyd, e.g. modify the memory of the process, or control it with chronyc over the Unix domain socket. Being able to prevent its start is not different. > Check whether the PID in the chronyd.pid file is the PID of the chronyd service instead of rejecting the file? Is there a portable way to do that? How would it work if there were two versions of chronyd installed under different names? The purpose of the pidfile is to prevent two chronyd instances running at the same time. -- Miroslav Lichvar -- To unsubscribe email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org with "unsubscribe" in the subject. For help email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org with "help" in the subject. Trouble? Email [email protected]