Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 16 Jan 2016 16:39:43 +0000
From: halfdog <>
Subject: Setgid/Setuid binary writing privilege escalation

Hash: SHA1

Hello List,

As first shown in [0] for escalation from user "man:man" to "man:root"
and later to "root:root", the issue was assigned low priority. Setgid
directories are rare, user "man" is rarely used, so escalation risk is
not so high. Apart from that, it was unclear, what would be correct
behavior regarding POSIX.

Later on in [1], using the very same method with overlayfs was
suitable to escalate from any user to root.

After looking at that more closely, I found today another method to
escalate e.g. on Ubuntu Trusty/Wily to any group to be found with
"find / -perm -02020", this is e.g. staff, mail, libuuid. As staff is
has rwx permissions on python dist-packages and /var/local, any root
process accessing those is at high risk to be used to escalate to uid
root also.

Hence it seems, that the problem [0] increases the attack surface in
general. Should it therefore be treated as a security vulnerability
and assigned a CVE?


- --
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
Version: GnuPG v1


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.