Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 28 Feb 2016 16:23:44 +0100
From: Aurelien Jarno <aurelien@...el32.net>
To: Jann Horn <jann@...jh.net>
Cc: oss-security@...ts.openwall.com, security@...nel.org,
	security@...ntu.com, security@...ian.org,
	Florian Weimer <fw@...eb.enyo.de>
Subject: Re: pt_chown timeline, CVE request [was: Access to /dev/pts devices
 via pt_chown and user namespaces]

On 2016-02-28 15:53, Jann Horn wrote:
> As others figured out in the private bug discussion, pt_chown is
> already not installed as setuid binary by glibc anymore.
> That it is present in Debian and Ubuntu is because of a distro patch
> in Debian, which Debian applied to work around the bug that the

To be correct, it's not really a patch, but rather a configure option.

> "[PATCH] devpts: Sensible /dev/ptmx & force newinstance" patch is
> supposed to fix. So with a fix for that issue applied, Debian and
> Ubuntu should be able to just drop the distro patch, fixing the
> vuln by removing pt_chown.

Note that in the meantime we have developed an alternative workaround
on the glibc side, which allows to not break systems with multiple
/dev/pts mounts, though the result is not POSIX compliant:

  https://sourceware.org/git/?p=glibc.git;a=commit;h=77356912e83601fd0240d22fe4d960348b82b5c3

This commit is included in glibc 2.23, and on the Debian side we have
backported it to glibc 2.21 and to 2.22, and pushed the result to the
users. We have also backported it to 2.19 (Debian jessie), but not
pushed it to users yet (it is in progress).

Aurelien

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@...el32.net                 http://www.aurel32.net

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ