[ glsa 201711-11 ] vde

[GLSA]

Gentoo Linux Security Advisory

Title: VDE: Privilege escalation (GLSA 201711-11)
Severity: normal
Exploitable: local
Date: 2017-11-12
Bug(s): #603382
ID: 201711-11

Synopsis

A vulnerability was discovered in VDE which may allow local users
to gain root privileges.


Background

VDE is an ethernet compliant virtual network that can be spawned over a
set of physical computer over the Internet.


Affected Packages

Package: net-misc/vde
Vulnerable: < 2.3.2-r4
Unaffected: >= 2.3.2-r4
Architectures: All supported architectures


Description

It was discovered that Gentoo’s default VDE installation suffered from
a privilege escalation vulnerability in the init script. This script
calls an unsafe ‘chown’ command which gives members from “qemu”
group root privileges.


Impact

A local attacker could escalate privileges to root.

Workaround

There is no known workaround at this time.

Resolution

All VDE users should upgrade to the latest version: