CVE-2016-7035

An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.

These are all security issues fixed in the libpacemaker-devel-1.1.15+git20161104.b6f251a-1.1 package on the GA media of openSUSE Tumbleweed.

This update for pacemaker fixes the following issues:

Security issues fixed:

• CVE-2016-7797: Notify other clients of a new connection only if the handshake has completed (bsc#967388, bsc#1002767).
• CVE-2016-7035: Fixed improper IPC guarding in pacemaker (bsc#1007433).

Bug fixes:

• bsc#1003565: crmd: Record pending operations in the CIB before they are performed
• bsc#1000743: pengine: Do not fence a maintenance node if it shuts down cleanly
• bsc#987348: ping: Avoid temporary files for fping check
• bsc#986644: libcrmcommon: report errors consistently when waiting for data on connection
• bsc#986644: remote: Correctly calculate the remaining timeouts when receiving messages

This update for pacemaker fixes the following issues:

• remote: Allow cluster and remote LRM API versions to diverge (bsc#1009076)

• libcrmcommon: fix CVE-2016-7035 (improper IPC guarding) (bsc#1007433)

• sysconfig: minor tweaks (typo, wording)

• spec: more robust check for systemd being in use

• spec: defines instead of some globals + error suppression

• various: issues discovered via valgrind and coverity

• attrd_updater: fix usage of HAVE_ATOMIC_ATTRD

• crmd: cl#5185 - Record pending operations in the CIB before they are performed (bsc#1003565)

• ClusterMon: fix to avoid matching other process with the same PID

• mcp: improve comments for sysconfig options

• remove openssl-devel and libselinux-devel as build dependencies

• tools: crm_standby --version/--help should work without cluster

• libpengine: only log startup-fencing warning once

• pacemaker.service: do not mistakenly suggest killing fenced

• libcrmcommon: report errors consistently when waiting for data on connection (bsc#986644)

• remote: Correctly calculate the remaining timeouts when receiving messages (bsc#986644)

• libfencing: report added node ID correctly

• crm_mon: Do not call setenv with null value

• pengine: Do not fence a maintenance node if it shuts down cleanly (bsc#1000743)

• ping: Avoid temporary files for fping check (bsc#987348)

• all: clarify licensing and copyrights

• crmd: Resend the shutdown request if the DC forgets

• ping: Avoid temp files in fping_check (bsc#987348)

• crmd: Ensure the R_SHUTDOWN is set whenever we ask the DC to shut us down

• crmd: clear remote node operation history only when it comes up

• libcib,libfencing,libtransition: handle memory allocation errors without CRM_CHECK()

• tools: make crm_mon XML schema handle resources with multiple active

• pengine: set OCF_RESKEY_CRM_meta_notify_active_* for multistate resources

• pengine: avoid null dereference in new same-node ordering option

• lrmd,libcluster: ensure g_hash_table_foreach() is never passed a null table

• crmd: don't log warning if abort_unless_down() can't find down event

• lib: Correction of the deletion of the notice registration.

• stonithd: Correction of the wrong connection process name.

• crmd: Keep a state of LRMD in the DC node latest.

• pengine: avoid transition loop for start-then-stop + unfencing

• libpengine: allow pe_order_same_node option for constraints

• cts: Restart systemd-journald with 'systemctl restart systemd-journald.socket' (bsc#995365)

• libcrmcommon: properly handle XML comments when comparing v2 patchset diffs

• crmd: don't abort transitions for CIB comment changes

• libcrmcommon: log XML comments correctly

• libcrmcommon: remove extraneous format specifier from log message

• remote: cl#5269 - Notify other clients of a new connection only if the handshake has completed (bsc#967388, bsc#1002767, CVE-2016-7797)

This update for pacemaker fixes one security issue and several non-security issues.

The following security issue has been fixed:

• libcrmcommon: Fix improper IPC guarding. (bsc#1007433, CVE-2016-7035)

The following non-security issues have been fixed:

• Add logrotate to reqs of pacemaker-cli.
• Add $remote_fs dependencies to the init scripts.
• all: Clarify licensing and copyrights.
• attrd,ipc: Prevent possible segfault on exit. (bsc#986056)
• attrd, libcrmcommon: Validate attrd requests better.
• attrd_updater: Fix usage of HAVE_ATOMIC_ATTRD.
• cib/fencing: Set status callback before connecting to cluster. (bsc#974108)
• ClusterMon: Fix to avoid matching other process with the same PID.
• crmd: Acknowledge cancellation operations for remote connection resources. (bsc#976865)
• crmd: Avoid timeout on older peers when cancelling a resource operation.
• crmd: Record pending operations in the CIB before they are performed. (bsc#1003565)
• crmd: Clear remote node operation history only when it comes up.
• crmd: Clear remote node transient attributes on disconnect. (bsc#981489)
• crmd: Don't abort transitions for CIB comment changes.
• crmd: Ensure the R_SHUTDOWN is set whenever we ask the DC to shut us down.
• crmd: Get full action information earlier. (bsc#981731)
• crmd: Graceful proxy shutdown is now tested. (bsc#981489)
• crmd: Keep a state of LRMD in the DC node latest.
• crmd,lrmd,liblrmd: Use defined constants for lrmd IPC operations. (bsc#981489)
• crmd: Mention that graceful remote shutdowns may cause connection failures. (bsc#981489)
• crmd/pengine: Handle on-fail=ignore properly. (bsc#981731)
• crmd/pengine: Implement on-fail=ignore without allow-fail. (bsc#981731)
• crmd: Remove dead code. (bsc#981731)
• crmd: Rename action number variable in process_graph_event(). (bsc#981731)
• crmd: Resend the shutdown request if the DC forgets.
• crmd: Respect start-failure-is-fatal even for artificially injected events. (bsc#981731)
• crmd: Set remote flag when gracefully shutting down remote nodes. (bsc#981489)
• crmd: Set the shutdown transient attribute in response to LRMD_IPC_OP_SHUTDOWN_REQ from remote nodes. (bsc#981489)
• crmd: Support graceful pacemaker_remote stops. (bsc#981489)
• crmd: Take start-delay into account for the timeout of the action timer. (bsc#977258)
• crmd: Use defined constant for magic 'direct nack' RC. (bsc#981731)
• crmd: Use proper resource agent name when caching metadata.
• crmd: When node load was reduced, crmd carries out a feasible action.
• crm_mon: Avoid logging errors for any CIB changes that we don't care about. (bsc#986931)
• crm_mon: Consistently print ms resource state.
• crm_mon: Do not call setenv with null value.
• crm_mon: Do not log errors for the known CIB changes that should be ignored. (bsc#986931)
• crm_mon: Fix time formatting on x32.
• cts: Avoid kill usage error if DummySD stop called when already stopped.
• CTS: Get Reattach test working again and up-to-date. (bsc#953192)
• cts: Simulate pacemaker_remote failure with kill. (bsc#981489)
• fencing/fence_legacy: Search capable devices by querying them through 'list' action for cluster-glue stonith agents. (bsc#986265)
• fencing: Record the last known names of nodes to make sure fencing requested with nodeid works. (bsc#974108)
• libais,libcluster,libcrmcommon,liblrmd: Don't use %z specifier.
• libcib,libfencing,libtransition: Handle memory allocation errors without CRM_CHECK().
• lib: Correction of the deletion of the notice registration.
• libcrmcommon: Correct directory name in log message.
• libcrmcommon: Ensure crm_time_t structure is fully initialized by API calls.
• libcrmcommon: Log XML comments correctly.
• libcrmcommon: Properly handle XML comments when comparing v2 patchset diffs.
• libcrmcommon: Really ensure crm_time_t structure is fully initialized by API calls.
• libcrmcommon: Remove extraneous format specifier from log message.
• libcrmcommon: Report errors consistently when waiting for data on…

Jan Pokorný and Alain Moulle discovered that Pacemaker incorrectly handled the IPC interface. A local attacker could possibly use this issue to execute arbitrary code with root privileges. (CVE-2016-7035)

Alain Moulle discovered that Pacemaker incorrectly handled authentication. A remote attacker could possibly use this issue to shut down connections, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7797)