oss-security - inetutils ftpd, rcp, rlogin, rsh, rshd, uucpd: Avoid potential privilege escalations by checking set*id() return values

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 30 Dec 2023 17:26:00 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Simon Josefsson <simon@...efsson.org>,
	Jeffrey Bencteux <jeffbencteux@...il.com>
Subject: inetutils ftpd, rcp, rlogin, rsh, rshd, uucpd: Avoid potential privilege escalations by checking set*id() return values

Hi,

Simon Josefsson has released inetutils 2.5 (a thankless job to take over
maintenance of legacy code like that):

https://www.mail-archive.com/info-gnu@gnu.org/msg03239.html

> This is to announce inetutils-2.5, a stable release.
> 
> GNU Networking Utilities (inetutils) contain traditional networking
> utilities, clients and servers, including ftp, telnet, inetd,
> rsh/rlogin, tftp, talk, syslogd, ping, traceroute, whois, hostname,
> dnsdomainname, ifconfig, and logger.

> * Noteworthy changes in release 2.5 (2023-12-29) [stable]
> 
> ** ftpd, rcp, rlogin, rsh, rshd, uucpd
> 
> *** Avoid potential privilege escalations by checking set*id() return values.
> Reported by Jeffrey Bencteux in
> <https://lists.gnu.org/archive/html/bug-inetutils/2023-07/msg00000.html>.

At the latter URL, there's a thread started by Jeffrey, which includes
revisions of a then-proposed patch.  My skimming of the latest patch in
there shows it still misses return value checks of initgroups() calls,
and additionally those are within "#ifdef HAVE_INITGROUPS", which means
they might not always be compiled in.  That's in rshd and uucpd.  ftpd's
patch context does not mention supplementary groups at all, so maybe
ftpd misses setting/clearing them entirely.  If so, that's even worse.

Distros generally get this kind of programs from other packages if at
all, which is a reason why the versions in inetutils haven't received
much scrutiny.  As an exception, notably Debian (and Ubuntu) does
package inetutils (and has already updated to 2.5 in unstable), but
doesn't install it by default and has some programs excluded.  It looks
like out of the affected ones above, only ftpd is included.

https://tracker.debian.org/pkg/inetutils

Jeffrey's initial message also says:

> There are cases where set*id() functions can fail, for example multiple
> calls to the clone() function can cause setuid() to fail when the user
> process limit is reached.

Linux kernel hardening patches have been mitigating this for some years,
and a mitigation (postponing RLIMIT_NPROC enforcement to execve(2) time,
if ever) got into upstream Linux, as I recall after this thread in 2011:

https://www.openwall.com/lists/kernel-hardening/2011/06/12/9

I hope on current Linux this dangerous failure mode is not triggerable,
but indeed programs must not rely on that, and I think inetutils isn't
Linux-only.

Also, initgroups() may still fail, and omitting it or setgroups() will
leave supplementary groups potentially inherited by a service intact.

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.