Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 01 Feb 2017 07:44:15 +0100
From: "Laszlo Boszormenyi (GCS)" <gcs@...ian.org>
To: oss security list <oss-security@...ts.openwall.com>
Subject: CVE-2017-0358 ntfs-3g: modprobe influence vulnerability via
 environment variables

Hi,

Jann Horn, Project Zero (Google) discovered that ntfs-3g, a read-write
NTFS driver for FUSE does not not scrub the environment before
executing modprobe to load the fuse module. This influence the behavior
of modprobe (MODPROBE_OPTIONS environment variable, --config and
--dirname options) potentially allowing for local root privilege
escalation if ntfs-3g is installed setuid. This is the case for Debian,
Ubuntu and probably Gentoo.

This problem is in the source since 2008, maybe before.
The fix is easy, use execle instead of execl and pass NULL as
environment variables.
-- cut --
--- ntfs-3g/src/lowntfs-3g.c.ref        2016-12-31 08:56:59.011749600 +0100
+++ ntfs-3g/src/lowntfs-3g.c    2017-01-05 14:41:52.041473700 +0100
@@ -4291,13 +4291,14 @@
        struct stat st;
        pid_t pid;
        const char *cmd = "/sbin/modprobe";
+       char *env = (char*)NULL;
        struct timespec req = { 0, 100000000 };   /* 100 msec */
        fuse_fstype fstype;

        if (!stat(cmd, &st) && !geteuid()) {
                pid = fork();
                if (!pid) {
-                       execl(cmd, cmd, "fuse", NULL);
+                       execle(cmd, cmd, "fuse", NULL, &env);
                        _exit(1);
                } else if (pid != -1)
                        waitpid(pid, NULL, 0);
--- ntfs-3g/src/ntfs-3g.c.ref   2016-12-31 08:56:59.022518700 +0100
+++ ntfs-3g/src/ntfs-3g.c       2017-01-05 15:45:45.912499400 +0100
@@ -3885,13 +3885,14 @@
        struct stat st;
        pid_t pid;
        const char *cmd = "/sbin/modprobe";
+       char *env = (char*)NULL;
        struct timespec req = { 0, 100000000 };   /* 100 msec */
        fuse_fstype fstype;

        if (!stat(cmd, &st) && !geteuid()) {
                pid = fork();
                if (!pid) {
-                       execl(cmd, cmd, "fuse", NULL);
+                       execle(cmd, cmd, "fuse", NULL, &env);
                        _exit(1);
                } else if (pid != -1)
                        waitpid(pid, NULL, 0);
-- cut --

CVE-2017-0358 is assigned to this issue by Salvatore Bonaccorso,
Debian Security Team.

Regards,
Laszlo/GCS
[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ