Date: Mon, 20 Jan 2020 14:40:55 +0100 From: Matthias Gerstner <mgerstner@...e.de> To: oss-security@...ts.openwall.com Subject: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock Hi, storeBackup  is a tool for performing disk-to-disk backups. In the course of a code review  for this package as it is included in openSUSE I found that the program, which typically runs as the root user, uses a fixed default path /tmp/storeBackup.lock to protect parallel instances of storeBackup against each other. This opens up a DoS attack vector for unprivileged local users. If an unprivileged user simply does this: $ echo 1 >/tmp/storeBackup.lock then possibly configured system backups won't be executed, because storeBackup assumes that an instance is already running. In this situation the program will not wait for the "other instance" to finish but simply exit immediately, doing nothing. Furthermore there's a race condition involved allowing a symlink attack. storeBackup first performs a stat() then an lstat() on /tmp/storeBackup.lock and only then opens it for creation. Thus if storeBackup runs as root and an unprivileged attacker wins this race condition then files can be created or overwritten. This way a system can be broken, or if additional conditions are met it might even allow to escalate privileges in some way. As a workaround users can pass an explicit --lockFile, -L parameter to storeBackup to specify a safe lockfile location not accessible to unprivileged users. There is currently no isolated patch available from upstream to deal with this problem. A new version 3.5.1 containing a fix is expected to be released (via savannah.gnu.org) in the course of next week. Attached is a patch authored by the openSUSE storeBackup package maintainer Jan Ritzerfeld that addresses the symlink attack vector by changing the way the lockfile is opened in the Perl code. Cheers Matthias : http://storebackup.org : https://bugzilla.suse.com/show_bug.cgi?id=1156767 -- Matthias Gerstner <matthias.gerstner@...e.de> Dipl.-Wirtsch.-Inf. (FH), Security Engineer https://www.suse.com/security Phone: +49 911 740 53 290 GPG Key ID: 0x14C405C971923553 SUSE Software Solutions Germany GmbH HRB 36809, AG Nürnberg Geschäftsführer: Felix Imendörffer View attachment "fix-tmp-lock-file-race-condition.patch" of type "text/x-diff" (708 bytes) Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.