[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 28 Feb 2016 16:23:44 +0100
From: Aurelien Jarno <aurelien@...el32.net>
To: Jann Horn <jann@...jh.net>
Cc: oss-security@...ts.openwall.com, security@...nel.org,
security@...ntu.com, security@...ian.org,
Florian Weimer <fw@...eb.enyo.de>
Subject: Re: pt_chown timeline, CVE request [was: Access to /dev/pts devices
via pt_chown and user namespaces]
On 2016-02-28 15:53, Jann Horn wrote:
> As others figured out in the private bug discussion, pt_chown is
> already not installed as setuid binary by glibc anymore.
> That it is present in Debian and Ubuntu is because of a distro patch
> in Debian, which Debian applied to work around the bug that the
To be correct, it's not really a patch, but rather a configure option.
> "[PATCH] devpts: Sensible /dev/ptmx & force newinstance" patch is
> supposed to fix. So with a fix for that issue applied, Debian and
> Ubuntu should be able to just drop the distro patch, fixing the
> vuln by removing pt_chown.
Note that in the meantime we have developed an alternative workaround
on the glibc side, which allows to not break systems with multiple
/dev/pts mounts, though the result is not POSIX compliant:
https://sourceware.org/git/?p=glibc.git;a=commit;h=77356912e83601fd0240d22fe4d960348b82b5c3
This commit is included in glibc 2.23, and on the Debian side we have
backported it to glibc 2.21 and to 2.22, and pushed the result to the
users. We have also backported it to 2.19 (Debian jessie), but not
pushed it to users yet (it is in progress).
Aurelien
--
Aurelien Jarno GPG: 4096R/1DDD8C9B
aurelien@...el32.net http://www.aurel32.net
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
