CVSS 3 Base Score:

Posted On:

February 28, 2012

Assessed Risk Level:

None

A bug in Puppet gives unexpected and improper group privileges to execs and types/providers.

When executing commands as a different user, Puppet leaves the forked process with Puppet's own group permissions. Specifically:

• Puppet's primary group (usually root) is always present in a process's supplementary groups.
• When an `exec` resource has a specified `user` attribute but not a `group` attribute, Puppet will set its effective GID to Puppet's own GID (usually root).
• Permanently changing a process's UID and GID won't clear the supplementary groups, leaving the process with Puppet's own supplementary groups (usually including root).

This causes any untrusted code executed by a Puppet exec resource to be given unexpectedly high permissions.

Status:

Affected software versions:Resolved in: