Auth bypass in Freeipa
CVE-2024-2698
A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If the target service argument is NULL, then it means the KDC is probing for general constrained delegation rules and not checking a specific S4U2Proxy request. In FreeIPA 4.11.0, the behavior of ipadb_match_acl() was modified to match the changes from upstream MIT Kerberos 1.20. However, a mistake resulting in this mechanism applies in cases where the target service argument is set AND where it is unset. This results in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (50.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 50.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Freeipa — versions 4.12.0
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8 — versions 8100020240528133707.823393f5
- Red Hat Enterprise Linux 8.8 Extended Update Support — versions 8080020240530051744.b0a6ceea
- Red Hat Enterprise Linux 9 — versions 0:4.11.0-15.el9_4
- Red Hat Enterprise Linux 9.2 Extended Update Support — versions 0:4.10.1-12.el9_2.2
- Red Hat Enterprise Linux — versions 6.0, 7.0, 8.0
- Red Hat Enterprise Linux Eus — versions 8.8, 9.2
Weakness classification (CWE)
References
- access.redhat.com/errata/RHSA-2024:3754 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2024:3755 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2024:3757 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2024:3759 (vendor-advisory, Vendor Advisory)
- access.redhat.com/security/cve/CVE-2024-2698 (vdb-entry, Vendor Advisory)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking, Mitigation, Issue Tracking, Vendor Advisory)
- www.freeipa.org/release-notes/4-12-1.html (Release Notes)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2024-2698?
- CVE-2024-2698 is a high-severity vulnerability in Freeipa, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2024-06-12.
- How severe is CVE-2024-2698?
- High severity. CVSS v3 base score is 8.8 out of 10.