Date: Sat, 16 Jan 2016 16:39:43 +0000 From: halfdog <me@...fdog.net> To: oss-security@...ts.openwall.com Subject: Setgid/Setuid binary writing privilege escalation -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello List, As first shown in  for escalation from user "man:man" to "man:root" and later to "root:root", the issue was assigned low priority. Setgid directories are rare, user "man" is rarely used, so escalation risk is not so high. Apart from that, it was unclear, what would be correct behavior regarding POSIX. Later on in , using the very same method with overlayfs was suitable to escalate from any user to root. After looking at that more closely, I found today another method to escalate e.g. on Ubuntu Trusty/Wily to any group to be found with "find / -perm -02020", this is e.g. staff, mail, libuuid. As staff is has rwx permissions on python dist-packages and /var/local, any root process accessing those is at high risk to be used to escalate to uid root also. Hence it seems, that the problem  increases the attack surface in general. Should it therefore be treated as a security vulnerability and assigned a CVE?  http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/  http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/ - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlaacjYACgkQxFmThv7tq+6wDQCffUVFOpFxKUa+TfUQrJ+0WpLy FnwAn3FN/wVZIZiqZABh6obBTaat1VCb =Q9HM -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.