oss-security - Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 30 Apr 2011 22:00:48 -0400
From: William Cohen <wcohen@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
CC: Jan Lieskovsky <jlieskov@...hat.com>,
        "Steven M. Christey" <coley@...us.mitre.org>,
        Stephane Chauveau <stephane.chauveau@...s-entreprise.com>,
        Maynard Johnson <maynardj@...ibm.com>,
        Robert Richter <robert.richter@....com>
Subject: Re: CVE Request -- oprofile -- Local privilege escalation via crafted
 opcontrol event parameter when authorized by sudo

On 04/29/2011 02:16 PM, Jan Lieskovsky wrote:
> 
> Hello Josh, Steve, vendors,
> 
>   It was found that oprofile profiling system did not properly sanitize
> the content of event argument, provided to oprofile profiling control
> utility (opcontrol). If a local unprivileged user was authorized by
> sudoers file to run the opcontrol utility, they could use the flaw
> to escalate their privileges (execute arbitrary code with the privileges
> of the privileged system user, root). Different vulnerability than
> CVE-2006-0576.
> 
> References:
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624212
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=700883
> 
> Could you allocate a CVE id for this?
> 
> Thank you & Regards, Jan.
> -- 
> Jan iankko Lieskovsky / Red Hat Security Response Team
> 
> P.S.: Oprofile is not encouraged to be run under sudo, but still
>       should not allow escalation of privileges.

I don't know if this is the best way to fix this issue, but attached is a patch that filters out all but alpha numeric characters and '_'. Feedback on the patch would be appreciated.

-Will

diff --git a/utils/opcontrol b/utils/opcontrol
index 3a8a814..487e158 100644
--- a/utils/opcontrol
+++ b/utils/opcontrol
@@ -385,12 +385,27 @@ create_dir()
 
 get_event()
 {
-	GOTEVENT=`eval "echo \\$CHOSEN_EVENTS_$1"`
+	clean1="`echo "${1}" | tr -cd '[:alnum:]_'`"
+	if [ "x$1" != "x$clean1" ]; then
+	    echo "Invalid event number \"$1\"."
+	    exit 1
+	fi
+        GOTEVENT=`eval "echo \\$CHOSEN_EVENTS_$clean1"`
 }
 
 set_event()
 {
-	eval "CHOSEN_EVENTS_$1=$2"
+	clean1="`echo "${1}" | tr -cd '[:alnum:]_'`"
+	clean2="`echo "${2}" | tr -cd '[:alnum:]_'`"
+	if [ "x$1" != "x$clean1" ]; then
+	    echo "Invalid event number \"$1\"."
+	    exit 1
+	fi
+	if [ "x$2" != "x$clean2" ]; then
+	    echo "Invalid event \"$2\"."
+	    exit 1
+	fi
+	eval "CHOSEN_EVENTS_$clean1=$clean2"
 }

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.