Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 1 Nov 2017 15:55:38 +0100
From: Jakub Wilk <jwilk@...lk.net>
To: oss-security@...ts.openwall.com
Subject: Re: Fw: Security risk of vim swap files

* Leonid Isaev <leonid.isaev@...a.colorado.edu>, 2017-10-31, 20:33:
>Just to clarify:
>1. vim creates a swap file applying user's umask.

I reproduced Kurt's findings on Debian unstable. Vim chmods the swapfile 
without honouring umask.

It does seem to keep read permissions of the original file, which is not 
the same thing as honouring umask, and which is a rather dubious 
behavior, especially when editing files belonging to other users.

>2. It is totally OK to edit files in /tmp or /dev/shm or /var/tmp.

No, it's not.

>The described "attack" when someone plants a /tmp/file.swp before 
>another user edits /tmp/file is not going to work because vim will 
>complain that the swap file already exists.

Sounds like a successful (albeit mild) DoS attack to me.
But it's worse than that. vim attempts to read the swapfile before 
showing you the complaint:

$ mkfifo -m 644 /tmp/.bar.swp
$ vim /tmp/bar
[hangs forever]

-- 
Jakub Wilk

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.