[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <aFHPvEcEt1uxE4BB@remnant.pseudorandom.co.uk>
Date: Tue, 17 Jun 2025 21:27:40 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-6019: LPE from allow_active to root in
libblockdev via udisks
On Tue, 17 Jun 2025 at 20:00:59 +0000, Qualys Security Advisory wrote:
>On Debian 12 and Ubuntu 24.04, when an unprivileged user logs in via
>sshd, PAM's pam_env module (from Linux-PAM 1.5.x) also reads this user's
>~/.pam_environment file, because pam_env's "user_readenv" is explicitly
>set to 1 in /etc/pam.d/sshd (it is 0 by default, since Linux-PAM 1.4.0).
The upcoming Debian 13 release no longer does this by default
(https://bugs.debian.org/1018260) and presumably neither do newer Ubuntu
releases.
I think the underlying problem here is that PAM has historically made it
ambiguous whether environment variables are trusted (trustable) or not.
The result is that some components (like pam_systemd's use of
XDG_SESSION_ID) behave as though the PAM environment is a trusted
channel through which the system can communicate information about a
session - indeed, there might not be any other way to get that
information - while other components (like pam_env with user_readenv)
behave as though the PAM environment is a piece of per-user
configuration that can be arbitrarily configured by the user for maximum
flexibility, but therefore can't be trusted by higher-privileged
components. It could reasonably be either of those, but it can't be
both.
The conflation of the "PAM environment" (ambiguously trusted) with
the environ(7) that will be inherited by the final program (untrusted
user configuration where maximum flexibility is an expected feature)
doesn't help this.
smcv
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
