oss-security - Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1434241886.291160.1304364270167.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Mon, 2 May 2011 15:24:30 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Stephane Chauveau <stephane.chauveau@...s-entreprise.com>,
        Maynard Johnson <maynardj@...ibm.com>,
        William Cohen <wcohen@...hat.com>,
        Robert Richter <robert.richter@....com>,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- oprofile -- Local privilege
 escalation via crafted opcontrol event parameter when authorized by sudo



----- Original Message -----
> Hello Josh, Steve, vendors,
> 
> It was found that oprofile profiling system did not properly sanitize
> the content of event argument, provided to oprofile profiling control
> utility (opcontrol). If a local unprivileged user was authorized by
> sudoers file to run the opcontrol utility, they could use the flaw
> to escalate their privileges (execute arbitrary code with the
> privileges
> of the privileged system user, root). Different vulnerability than
> CVE-2006-0576.
> 
> References:
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624212
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=700883
> 
> Could you allocate a CVE id for this?
> 
> Thank you & Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
> 
> P.S.: Oprofile is not encouraged to be run under sudo, but still
> should not allow escalation of privileges.


I'm giving this an ID. oprofile is one of those tools that is likely to be
run as a privileged user.

Please use CVE-2011-1760

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.