[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230418154016.GA959@openwall.com>
Date: Tue, 18 Apr 2023 17:40:16 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Ruihan Li <lrh2000@....edu.cn>
Subject: Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution
On Sun, Apr 16, 2023 at 06:12:18PM +0800, Ruihan Li wrote:
> The exploitation works as long as there are setuid programs (or more
> precisely, programs with the CAP_NET_ADMIN capability) that invokes ioctl
> calls on stdin, stdout, or stderr. In most Linux distros, a quick (but very
> coarse) test reveals that quite a few setuid programs are using ioctl system
> calls, which are marked with 'V' in the table below:
> ```
> # find . -user root -perm -4000 -exec sh -c "strace -e trace=ioctl {} < /dev/null 2>&1 > /dev/null | grep ioctl > /dev/null && echo -n 'V ' || echo -n 'S '; echo {};" \; | sort
> S ./chage
> S ./expiry
> S ./fusermount
> S ./fusermount3
> S ./gpasswd
> S ./ksu
> S ./mount.cifs
> S ./sg
> S ./umount
> V ./chfn
> V ./chsh
> V ./mount
> V ./newgrp
> V ./passwd
> V ./pkexec
> V ./screen-4.9.0
> V ./su
> V ./sudo
> V ./unix_chkpwd
> ```
> After manually checking the strace output, it is found that all of these ioctl
> users are using ioctl calls on stdin, stdout, or stderr to get or set some tty
> parameters. Note that exactly no arguments are passed to these setuid
> programs. If some crafted arguments are passed, the number of ioctl users may
> increase. As a result, a number of linux distros can be vulnerable to the
> exploitation.
BTW, even with the kernel bug fixed, there are ioctl number clashes
between different devices, so even e.g. isatty(3) is not necessarily
safe if called with elevated privileges under a possible confused deputy
scenario. Here's strace showing some clashes on older Linux/i386:
$ cat isatty.c
int main(void) { return isatty(0); }
$ gcc isatty.c -o isatty
$ strace -e ioctl ./isatty
ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
IIRC, I was the one to add this feature to strace 20+ years ago:
* Sat Jun 08 2002 Solar Designer <solar-at-owl.openwall.com>
- Updated to today's CVS version (post-4.4) with an additional fix for
displaying all possible ioctl names when there's more than one match,
So the number clashes were known, but the security relevance maybe not.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
