Старый 10.12.2014, 16:57   #1
Аватар для Pashkela
Регистрация: 05.07.2010
Сообщений: 1,243
По умолчанию CVE-2013-4288 polkit unix-process subject for authorization is racy

From: Sebastian Krahmer <krahmer@...e.de>
To: distros@...openwall.org
Subject: [vs-plain] polkit races
Date: Wed, 28 Aug 2013 10:17:37 +0200


The polkit unix-process subject for authorization is racy. It depended
on the (PID, startup_time) pair to be passed to polkit which then used /proc/PID/status
to find out the UID the process belongs to. Meanwhile the process could
have started a suid or pkexec process, changing the euid and/or uid at will.
The startup_time does not protect here, as its not changed across an execve().

Using /proc/PID/loginuid wont work either, as one could abuse fork-spawning
processes such as sshd, apache etc. to re-use recently freed process slots,
faking the loginuid. startup_time would theoretically help here, yet as
its not atomically passed along the message which is subject to polkit
authorization, the privileged process needs to learn it by looking up
/proc/PID/, which is racy again.

Therefore the only thing that could be used is the UID that is passed
atomically in the peer cred struct when receiving the message in question.

The whole thing needs fixing in polkit, to deprecate PID authorization
as well as several core packages to make use of the new API, or use
systembus authorization.

After discussing with upstream, Colin Walters made this private git of patches

http://people.freedesktop.org/~walters/secret/38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c 0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b/

Feel free to suggest improvements if necessary.

As required by list policy, I request a CRD of Sept 11th.

We also need CVE's assigned.

A PoC with example client/server which demonstrates the race
can be found here (it basically simulates libvirtd's way of


Pashkela вне форума   Ответить с цитированием

Опции темы Поиск в этой теме
Поиск в этой теме:

Расширенный поиск
Опции просмотра

Ваши права в разделе
Вы не можете создавать новые темы
Вы не можете отвечать в темах
Вы не можете прикреплять вложения
Вы не можете редактировать свои сообщения

BB коды Вкл.
Смайлы Вкл.
[IMG] код Вкл.
HTML код Выкл.

Быстрый переход

Powered by vBulletin® Version 3.8.5
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd. Перевод: zCarot