[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <e4945331-396e-5696-1c67-70dbbcd20c32@halfdog.net>
Date: Sat, 16 Jan 2016 16:39:43 +0000
From: halfdog <me@...fdog.net>
To: oss-security@...ts.openwall.com
Subject: Setgid/Setuid binary writing privilege escalation
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello List,
As first shown in [0] for escalation from user "man:man" to "man:root"
and later to "root:root", the issue was assigned low priority. Setgid
directories are rare, user "man" is rarely used, so escalation risk is
not so high. Apart from that, it was unclear, what would be correct
behavior regarding POSIX.
Later on in [1], using the very same method with overlayfs was
suitable to escalate from any user to root.
After looking at that more closely, I found today another method to
escalate e.g. on Ubuntu Trusty/Wily to any group to be found with
"find / -perm -02020", this is e.g. staff, mail, libuuid. As staff is
has rwx permissions on python dist-packages and /var/local, any root
process accessing those is at high risk to be used to escalate to uid
root also.
Hence it seems, that the problem [0] increases the attack surface in
general. Should it therefore be treated as a security vulnerability
and assigned a CVE?
[0]
http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/
[1]
http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/
- --
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlaacjYACgkQxFmThv7tq+6wDQCffUVFOpFxKUa+TfUQrJ+0WpLy
FnwAn3FN/wVZIZiqZABh6obBTaat1VCb
=Q9HM
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
