wapiflapi <[email protected]> wrote:
...
|For the record the path to the mailbox file against which this is
|checked is also passed as an argument and controlled by the
|user/attacker. So the owner check is in no way a mitigation.
I was just about to write to the list that i wonder whether that
makes up a release, since i except v14.9.0 to be released some
time in February:
Hello.
Just to reiterate this.
| FIX privsep.c, yes, vulnerability (wapiflapi)..
|
| wapiflapi (wapiflapi at yahoo dot fr) reported a vulnerability
| when the privsep program is driven directly: it is possible to
| pass a random string which includes path separators.
|
| This random string is used to build the path name of a an
| O_EXCLusively created file, which then is fchown()ed to the owner
| of the mailbox the privsep child is to be used to create a lock
So, the O_EXCL open(2)ed file has been created exclusively, i.e.,
it hasn't overwritten anything, and as root (or the SUID of the
privilege-separated child).
| file for. The exclusively created file is then removed, whether
| the race has been won or not.
It will now be removed again, after link(2) has been used to
create..
| The privsep child will refuse to run unless the executing user
| owns the mailbox file, that is, has read (or read/write, dependent
| on mode), the target of the link will always be the name of said
| mailbox with a ".lock" suffix (Unix dotlock locking).
the dotlock file, which is in the same directory as "the mailbox"
that we create a lock file for. The above file no longer exists.
I really wonder whether the about two weeks to v14.9.0 should be
filled with a v14.8.16 because of this. E.g.,
Trying O_EXCL steffen.lock.wales.local.5HCXRG1eekjsw9UA
[mailbox]
[dotlock ]
[hostname ]
[random ]
Hostname and random can, except on [stable/stable, master etc.] be
forced to contain relative paths.
The reporter (thanks!) used PolicyKit, but what else can this
attack vector be used for? Maybe some inotify trigger that would
normally only be run as root _can_ be triggered, too.
--steffen
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
__________________________________
[email protected]
