Privilege escalation through Python module imports

[Martin Pitt]

Gabriel Campana <email address hidden> reported a security vulnerability in Apport:

ummary
=======

A privilege escalation was discovered in apport.

Details
=======

The command line of the process triggering the coredump is checked to
determine if it's a script. If the interpreter is Python and the first
argument is ``-m``, the method ``_python_module_path`` is called to find
the path of the culprit module
(``/usr/lib/python3/dist-packages/apport/report.py``)::

    @classmethod
    def _python_module_path(klass, module):
        '''Determine path of given Python module'''

        module = module.replace('/', '.')

        try:
            m = __import__(module)
            m
        except:
            return None

        [...]

Any Python module in ``sys.path`` can be imported because the variable
``module`` is under control of the attacker. It should be noted that
``_python_module_path`` is called with euid=0, and apport relies on the
process name to determine if the process is an interpreter. A crash of
Python isn't required to reach this function: any process name starting
with ``python`` and producing a core dump is enough. As an example, the
following bash script triggers the bug::

       #!/bin/bash

        cat <<EOF > python.c
        int main(void) { *(int *)0 = 0; return 0; }
        EOF
        gcc -o python python.c
        ./python -m venv.__main__

and results in the creation of a "lightweight virtual Python
environment" in the root directory::

        $ ./lol.sh
        ./lol.sh: line 8: 7665 Segmentation fault (core dumped)
        $ ls -l / | head -4
        total 100
        drw-rw---- 5 root root 4096 Sep 29 16:09 7665
        drwxr-xr-x 2 root root 4096 Sep 29 05:41 bin
        drwxr-xr-x 3 root root 4096 Sep 29 06:20 boot

Criticity
=========

Importing an arbitrary module is a security issue because a few standard
modules rely on files in the home directory associated to the uid of the
dumped process. A fully working exploit has been written (targetting
Python2 and Python3), giving an instant root shell to the attacker.
While the exploitation is straightforward for Python2, a bit more work
was required to find a suitable module for Python3.

The vulnerability seems to be limited to Ubuntu Dekstop because apport
is disabled on Ubuntu Server.

[Martin Pitt (pitti)]

Gabriel provided a fix for this, by rewriting _python_module_path() in a way to avoid actually importing the module. I created a test case for this which reproduces the issue with unittest.__main__ (which isn't an actual exploit, but sufficient to demonstrate the problem).

Security team, can you please assign a CVE and CRD? Once we agree to this fix, I'll provide backports for earlier Ubuntu stable releases.

[Marc Deslauriers (mdeslaur)]

Please use CVE-2015-1341 for this issue.

How about a CRD of 2015-10-27?

[Martin Pitt (pitti)]

Sounds good, thanks!

[Martin Pitt (pitti)]

This is the debdiff for wily (the patch for trunk applies without issues).

This includes a tiny fix for the test suite from http://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3020 . They started failing around October 15th (http://autopkgtest.ubuntu.com/packages/a/apport/wily/amd64/), presumably due to some side issues of the new apt/dpkg, but it would be really useful to have them passing again.

I'll backport that to the previous releases as well, as it also seems to affect e. g. http://autopkgtest.ubuntu.com/packages/a/apport/vivid/amd64/

I have the commits for this security fix and the release tag locally; I'll push them to lp:~ubuntu-core-dev/ubuntu/wily/apport/ubuntu when this gets published.

[Martin Pitt (pitti)]

debdiff for vivid, with same considerations as for wily. As for wily, local build, test, adt-run all pass.

[Martin Pitt (pitti)]

debdiff for trusty. There are three test failures in adt-run, like in http://autopkgtest.ubuntu.com/packages/a/apport/trusty/amd64/, but the "report" tests (particularly the new one for this bug) succeed.

[Martin Pitt (pitti)]

Sorry, this is the right one for trusty.

[Martin Pitt (pitti)]

And finally, debdiff for precise.

[Marc Deslauriers (mdeslaur)]

Thanks for the debdiffs!

[Launchpad Janitor (janitor)]

This bug was fixed in the package apport - 2.0.1-0ubuntu17.13

---------------
apport (2.0.1-0ubuntu17.13) precise-security; urgency=medium

  * SECURITY FIX: When determining the path of a Python module for a program
    like "python -m module_name", avoid actually importing and running the
    module; this could lead to local root privilege escalation. Thanks to
    Gabriel Campana for discovering this and the fix!
    (CVE-2015-1341, LP: #1507480)

 -- Martin Pitt <email address hidden> Thu, 22 Oct 2015 15:50:47 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package apport - 2.19.1-0ubuntu4

---------------
apport (2.19.1-0ubuntu4) wily-security; urgency=medium

  * test_backend_apt_dpkg.py: Reset internal apt caches between tests. Avoids
    random test failures due to leaking paths from previous test cases.
  * SECURITY FIX: When determining the path of a Python module for a program
    like "python -m module_name", avoid actually importing and running the
    module; this could lead to local root privilege escalation. Thanks to
    Gabriel Campana for discovering this and the fix!
    (CVE-2015-1341, LP: #1507480)

 -- Martin Pitt <email address hidden> Thu, 22 Oct 2015 14:46:22 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package apport - 2.17.2-0ubuntu1.7

---------------
apport (2.17.2-0ubuntu1.7) vivid-security; urgency=medium

  * test_backend_apt_dpkg.py: Reset internal apt caches between tests. Avoids
    random test failures due to leaking paths from previous test cases.
  * SECURITY FIX: When determining the path of a Python module for a program
    like "python -m module_name", avoid actually importing and running the
    module; this could lead to local root privilege escalation. Thanks to
    Gabriel Campana for discovering this and the fix!
    (CVE-2015-1341, LP: #1507480)

 -- Martin Pitt <email address hidden> Thu, 22 Oct 2015 15:05:43 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package apport - 2.14.1-0ubuntu3.18

---------------
apport (2.14.1-0ubuntu3.18) trusty-security; urgency=medium

  * test_backend_apt_dpkg.py: Reset internal apt caches between tests. Avoids
    random test failures due to leaking paths from previous test cases.
  * SECURITY FIX: When determining the path of a Python module for a program
    like "python -m module_name", avoid actually importing and running the
    module; this could lead to local root privilege escalation. Thanks to
    Gabriel Campana for discovering this and the fix!
    (CVE-2015-1341, LP: #1507480)

 -- Martin Pitt <email address hidden> Thu, 22 Oct 2015 15:15:37 +0200

[Martin Pitt (pitti)]

Published new upstream release https://launchpad.net/apport/trunk/2.19.2 which includes the fix.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apport - 2.19.2-0ubuntu1

---------------
apport (2.19.2-0ubuntu1) xenial; urgency=medium

  * New upstream release. Changes since previous snapshot:
    - SECURITY FIX: When determining the path of a Python module for a program
      like "python -m module_name", avoid actually importing and running the
      module; this could lead to local root privilege escalation. Thanks to
      Gabriel Campana for discovering this and the fix!
      (CVE-2015-1341, LP: #1507480)
    - test_backend_apt_dpkg.py: Reset internal apt caches between tests.
      Avoids random test failures due to leaking paths from previous test
      cases.
  * debian/control: Adjust Vcs-Bzr: for xenial branch.
  * debian/control: Drop obsolete XS-Testsuite: header.

 -- Martin Pitt <email address hidden> Tue, 27 Oct 2015 14:33:28 +0100