CVE-2018-12029

Vulnerability

A race condition exists in the Nginx module of Phusion Passenger versions 3.x through 5.x prior to 5.3.2 [1][2]. The issue occurs when the passenger_instance_registry_dir is configured to a non-standard directory with permissions that allow the www-data user to write, e.g., /opt/mytmp [2]. When Passenger creates the control_process.pid file, it calls chown() to change the file's owner from root to www-data [2]. There is a time window between file creation and the chown() call during which an attacker can replace the file with a symlink [1][2].

Exploitation

An attacker already holding www-data privileges and with write access to the passenger_instance_registry_dir directory can exploit this race condition [2]. When Nginx is restarted, the module creates the pid file as root and then proceeds to change its ownership. The attacker must replace the legitimate file with a symbolic link targeting a sensitive file (e.g., root's crontab) before the chown() syscall executes [1]. The race window is short, but the attack can be repeated by restarting Nginx multiple times [2].

Impact

Successful exploitation results in the attacker (the www-data user) gaining ownership of any file on the filesystem that is targeted by the symlink [1][2]. This includes critical system files such as root's crontab, which can be subsequently modified to execute arbitrary commands with root privileges, leading to full local privilege escalation [1].

Mitigation

The vulnerability is fixed in Phusion Passenger version 5.3.2 [1][2]. Users should upgrade to this version or later. Gentoo users can update via emerge --sync && emerge --ask --verbose ">=www-apache/passenger-5.3.2" [4]. As a workaround, ensure that the passenger_instance_registry_dir is not writable by unprivileged users, or use the default directory which is not exploitable [2].