Date: Mon, 30 Mar 2015 01:31:50 -0400 From: Rich Felker <dalias@...c.org> To: busybox@...ybox.net Cc: musl@...ts.openwall.com Subject: Busybox on musl is affected by CVE-2015-1817 For details on CVE-2015-1817, see: http://www.openwall.com/lists/musl/2015/03/30/1 With musl-linked Busybox installed setuid and ping enabled, exploiting this issue is trivial. While CVE-2015-1817 is certainly musl's fault, there are two changes to Busybox I'd like to propose that would have prevented it from being exploitable: 1. Having setuid utilities like ping obtain the resource they need (in the case of ping, SOCK_RAW) without processing user input at all, then fully dropping root (setuid(getuid())) before doing anything. This has been standard practice for setuid programs since the 90s and it feels bad that busybox is not doing it. 2. Reconsider the rejection of the patch to add SOCK_DGRAM support for ping, which allows it to run without root. Do either or both of these sound acceptable? Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.