Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 25 May 2012 02:56:46 +0400
From: Solar Designer <solar@...nwall.com>
To: Steve Grubb <sgrubb@...hat.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE Request: powerdns does not clear supplementary groups

On Thu, May 24, 2012 at 06:15:53PM -0400, Steve Grubb wrote:
> Here is a real life case:
> 
> + if ( initgroups(pw->pw_name, NULL) != 0 || setgid(pw->pw_gid) != 0 ||
> +                                setuid(pw->pw_uid) != 0 ) 
> 
> This is not upstream. This is a patch to drop capabilities by changing uid/gid. 
> The person writing the patch intended to do the right thing - but failed. See 
> the bug? This is in a network facing daemon that parses untrusted network 
> packets.

Wow.  The NULL results in group 0 being added to the supplementary
groups list (so it survives the setgid(), at least on my quick test).

How did you spot this?  Compiler warning?

"passing arg 2 of `initgroups' makes integer from pointer without a cast"

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.