Date: Sun, 28 Feb 2016 16:23:44 +0100 From: Aurelien Jarno <aurelien@...el32.net> To: Jann Horn <jann@...jh.net> Cc: oss-security@...ts.openwall.com, security@...nel.org, security@...ntu.com, security@...ian.org, Florian Weimer <fw@...eb.enyo.de> Subject: Re: pt_chown timeline, CVE request [was: Access to /dev/pts devices via pt_chown and user namespaces] On 2016-02-28 15:53, Jann Horn wrote: > As others figured out in the private bug discussion, pt_chown is > already not installed as setuid binary by glibc anymore. > That it is present in Debian and Ubuntu is because of a distro patch > in Debian, which Debian applied to work around the bug that the To be correct, it's not really a patch, but rather a configure option. > "[PATCH] devpts: Sensible /dev/ptmx & force newinstance" patch is > supposed to fix. So with a fix for that issue applied, Debian and > Ubuntu should be able to just drop the distro patch, fixing the > vuln by removing pt_chown. Note that in the meantime we have developed an alternative workaround on the glibc side, which allows to not break systems with multiple /dev/pts mounts, though the result is not POSIX compliant: https://sourceware.org/git/?p=glibc.git;a=commit;h=77356912e83601fd0240d22fe4d960348b82b5c3 This commit is included in glibc 2.23, and on the Debian side we have backported it to glibc 2.21 and to 2.22, and pushed the result to the users. We have also backported it to 2.19 (Debian jessie), but not pushed it to users yet (it is in progress). Aurelien -- Aurelien Jarno GPG: 4096R/1DDD8C9B aurelien@...el32.net http://www.aurel32.net [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ