[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAL6HQvEU_KcXFrvgLoP1woAyV6U-8onZBJ=4vs-FE0gxLCrvYw@mail.gmail.com>
Date: Thu, 27 Jan 2022 13:45:33 +0100
From: Kai Lüke <kai@...volk.io>
To: oss-security@...ts.openwall.com
Subject: Re: pwnkit: Local Privilege Escalation in polkit's
pkexec (CVE-2021-4034)
> Dominik Czarnota:
> And many other binaries also do things incorrectly
The setuid binary polkit-agent-helper-1 has checks in place for argc
in the usual code paths but when it's not executed with euid 0 (i.e.,
it's not setuid), there is an argv[0] deref through printf which
luckily handles gracefully and prints "(null)" instead:
polkit-agent-helper-1: needs to be setuid root
PAM_ERROR_MSG Incorrect permissions on (null) (needs to be setuid root)
I wonder however, if the amount of setuid binaries couldn't be
reduced, in this case by offloading the PAM auth check to the polkit
daemon again (which could verify the client's programs uid through the
Unix Domain Socket).
An alternative to pkexec that is not setuid but also uses polkit auth
is systemd-run (here is an attempt at mimicking the sudo UX:
https://gist.github.com/pothos/73dd4f7694acc3b6bbed614438f6e2b1).
--
Kinvolk GmbH | Adalbertstr.6a, 10999 Berlin | tel: +491755589364
Geschäftsführer/Directors: Benjamin Owen Orndorff
Registergericht/Court of registration: Amtsgericht Charlottenburg
Registernummer/Registration number: HRB 171414 B
Ust-ID-Nummer/VAT ID number: DE302207000
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
