[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <1485931455.2391.3.camel@debian.org>
Date: Wed, 01 Feb 2017 07:44:15 +0100
From: "Laszlo Boszormenyi (GCS)" <gcs@...ian.org>
To: oss security list <oss-security@...ts.openwall.com>
Subject: CVE-2017-0358 ntfs-3g: modprobe influence vulnerability via
environment variables
Hi,
Jann Horn, Project Zero (Google) discovered that ntfs-3g, a read-write
NTFS driver for FUSE does not not scrub the environment before
executing modprobe to load the fuse module. This influence the behavior
of modprobe (MODPROBE_OPTIONS environment variable, --config and
--dirname options) potentially allowing for local root privilege
escalation if ntfs-3g is installed setuid. This is the case for Debian,
Ubuntu and probably Gentoo.
This problem is in the source since 2008, maybe before.
The fix is easy, use execle instead of execl and pass NULL as
environment variables.
-- cut --
--- ntfs-3g/src/lowntfs-3g.c.ref 2016-12-31 08:56:59.011749600 +0100
+++ ntfs-3g/src/lowntfs-3g.c 2017-01-05 14:41:52.041473700 +0100
@@ -4291,13 +4291,14 @@
struct stat st;
pid_t pid;
const char *cmd = "/sbin/modprobe";
+ char *env = (char*)NULL;
struct timespec req = { 0, 100000000 }; /* 100 msec */
fuse_fstype fstype;
if (!stat(cmd, &st) && !geteuid()) {
pid = fork();
if (!pid) {
- execl(cmd, cmd, "fuse", NULL);
+ execle(cmd, cmd, "fuse", NULL, &env);
_exit(1);
} else if (pid != -1)
waitpid(pid, NULL, 0);
--- ntfs-3g/src/ntfs-3g.c.ref 2016-12-31 08:56:59.022518700 +0100
+++ ntfs-3g/src/ntfs-3g.c 2017-01-05 15:45:45.912499400 +0100
@@ -3885,13 +3885,14 @@
struct stat st;
pid_t pid;
const char *cmd = "/sbin/modprobe";
+ char *env = (char*)NULL;
struct timespec req = { 0, 100000000 }; /* 100 msec */
fuse_fstype fstype;
if (!stat(cmd, &st) && !geteuid()) {
pid = fork();
if (!pid) {
- execl(cmd, cmd, "fuse", NULL);
+ execle(cmd, cmd, "fuse", NULL, &env);
_exit(1);
} else if (pid != -1)
waitpid(pid, NULL, 0);
-- cut --
CVE-2017-0358 is assigned to this issue by Salvatore Bonaccorso,
Debian Security Team.
Regards,
Laszlo/GCS
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
