Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20191204220511.GA16998@openwall.com>
Date: Wed, 4 Dec 2019 23:05:11 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Authentication vulnerabilities in OpenBSD

On Wed, Dec 04, 2019 at 08:49:22PM +0000, Qualys Security Advisory wrote:
> 1. CVE-2019-19521: Authentication bypass

> This is the second piece of the puzzle: if an attacker specifies the
> username "-schallenge" (or "-schallenge:passwd" to force a passwd-style
> authentication), then the authentication is automatically successful and
> therefore bypassed.

Wow, this is the new -froot.

> 2. CVE-2019-19520: Local privilege escalation via xlock
> ==============================================================================
> 
> On OpenBSD, /usr/X11R6/bin/xlock is installed by default and is
> set-group-ID "auth", not set-user-ID; the following check is therefore
> incomplete and should use issetugid() instead:
> 
> ------------------------------------------------------------------------------
> 101 _X_HIDDEN void *
> 102 driOpenDriver(const char *driverName)
> 103 {
> ...
> 113    if (geteuid() == getuid()) {
> 114       /* don't allow setuid apps to use LIBGL_DRIVERS_PATH */
> 115       libPaths = getenv("LIBGL_DRIVERS_PATH");
> ------------------------------------------------------------------------------
> 
> A local attacker can exploit this vulnerability and dlopen() their own
> driver to obtain the privileges of the group "auth":

I think this library issue isn't OpenBSD-specific.  A quick Google web
search for LIBGL_DRIVERS_PATH finds that Mesa appears to have the same
issue, and it also finds that we should also search for GBM_DRIVERS_PATH
(apparently, for older Mesa) and maybe EGL_DRIVERS_PATH and EGL_DRIVER,
and LIBVA_DRIVERS_PATH and LIBVA_DRIVER_NAME.  There are probably more.

Related discussion for X.Org, which ends with Alan Coopersmith saying:

"Yeah, I really would rather not have a setuid-root program dlopen and execute
code from a user supplied path.  Can we have something in there to prevent
disasters, such as issetugid() or secure_getenv()?"

[PATCH xserver] Search for DRI drivers at LIBGL_DRIVERS_PATH environment variable.
https://lists.x.org/archives/xorg-devel/2016-April/049336.html

It sounds like the patch adding the dangerous getenv() didn't get in,
but I didn't verify that.

Alexander

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.