oss-security - Re: tuned: local root exploit in D-Bus method instance_create and other issues in tuned >= 2.23 (CVE-2024-52336, CVE-2024-52337)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z0mRi_ODyP4F8LrX@kasco.suse.de>
Date: Fri, 29 Nov 2024 11:03:53 +0100
From: Matthias Gerstner <mgerstner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: tuned: local root exploit in D-Bus method
 instance_create and other issues in tuned >= 2.23 (CVE-2024-52336,
 CVE-2024-52337)

Hello Simon,
 
On Thu, Nov 28, 2024 at 12:14:07PM +0000, Simon McVittie wrote:
> This should be easily resolvable if the authors of tuned want to do so,
> without needing to resort to relying on hard-to-predict cookie values.
> Clients of the D-Bus system bus can identify other clients of the system
> bus, by calling the GetConnectionCredentials method on the message bus
> itself (this is how polkit works).
[...]
> (Behind the scenes, this is implemented by the message bus using
> SO_PEERCRED, SO_PEERSEC, etc. on each client connection, or the closest
> available equivalent of SO_PEERCRED on various non-Linux OSs.)

thanks for the hint! Relying on D-Bus and kernel features is surely the
cleanest way to implement this.

Cheers

Matthias

-- 
Matthias Gerstner <matthias.gerstner@...e.de>
Security Engineer
https://www.suse.com/security
GPG Key ID: 0x14C405C971923553
 
SUSE Software Solutions Germany GmbH
HRB 36809, AG Nürnberg
Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.