Local privilege escalation via guest user login

[Tyler Hicks]

It was discovered that a local attacker could watch for lightdm's
guest-account script to create a /tmp/guest-XXXXXX file and then quickly create
the lowercase representation of the guest user's home directory before lightdm
could. This allowed the attacker to have control of the guest user's home
directory and, subsequently, gain control of an arbitrary directory in the
filesystem which could lead to privilege escalation.

[Tyler Hicks (tyhicks)]

Here's what I think is the most simple change possible to address this issue. Note that, as described in the commit message, it still allows for a local user to DoS the guest login feature.

@Robert, I'll leave the decision up to you if you want to implement a more complete fix for this issue.

[Robert Ancell (robert-ancell)]

This bug was introduced in revision 2233 (1.17.1).

[Robert Ancell (robert-ancell)]

@Tyler, I'm happy with the fix you've proposed. I think this feature is not critical enough that solving the DoS issue is urgent.

As far as I know there's no method using a shell script to more intelligently generate the username / directory. To solve that the guest creation script would need to use another language.

[Robert Ancell (robert-ancell)]

Merge proposal that brought this change in (bug 1496939):
https://code.launchpad.net/~lbssousa/lightdm/guest-account-cross-distro/+merge/274761

[Tyler Hicks (tyhicks)]

This is CVE-2017-7358

[Tyler Hicks (tyhicks)]

@Robert, to solve the DoS in that shell script you'd need to first securely create a tmp dir such as /tmp/lightdm-XXXXXX and then create another guest-XXXXXX tmp dir underneath it. The only downside that I can see is that the /tmp/lightdm-XXXXXX directory would not be cleaned up when the guest user ended their session.

[Robert Ancell (robert-ancell)]

@Tyler, I think that change will make the script even more complicated so I'll stick with the proposed patch.

[Tyler Hicks (tyhicks)]

I'm attaching a slightly updated patch for this issue. I had incorrectly given credit to the individual that reported this issue to Ubuntu Security as being the person that discovered the issue. Maor Schwartz of Beyond Security reported the issue but the individual that actually discovered the issue remains anonymous.

[Launchpad Janitor (janitor)]

This bug was fixed in the package lightdm - 1.19.5-0ubuntu1.1

---------------
lightdm (1.19.5-0ubuntu1.1) yakkety-security; urgency=medium

  * SECURITY UPDATE: Directory traversal allowing arbitrary directory
    ownership and privilege escalation (LP: #1677924)
    - debian/guest-account.sh: Detect existing malicious guest user home dirs
      before proceeding with guest user creation
    - CVE-2017-7358

 -- Tyler Hicks <email address hidden> Fri, 31 Mar 2017 16:04:04 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package lightdm - 1.18.3-0ubuntu1.1

---------------
lightdm (1.18.3-0ubuntu1.1) xenial-security; urgency=medium

  * SECURITY UPDATE: Directory traversal allowing arbitrary directory
    ownership and privilege escalation (LP: #1677924)
    - debian/guest-account.sh: Detect existing malicious guest user home dirs
      before proceeding with guest user creation
    - CVE-2017-7358

 -- Tyler Hicks <email address hidden> Fri, 31 Mar 2017 16:04:04 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package lightdm - 1.22.0-0ubuntu2

---------------
lightdm (1.22.0-0ubuntu2) zesty; urgency=medium

  * SECURITY UPDATE: Directory traversal allowing arbitrary directory
    ownership and privilege escalation (LP: #1677924)
    - debian/guest-account.sh: Detect existing malicious guest user home dirs
      before proceeding with guest user creation
    - CVE-2017-7358

 -- Robert Ancell <email address hidden> Wed, 05 Apr 2017 10:34:32 +1200

[Tyler Hicks (tyhicks)]

As a note to any backporters, the original fix for this bug should include the following change as well:

  https://code.launchpad.net/~tyhicks/lightdm/guest-dir-perms/+merge/322906

It is technically optional but definitely recommended.

[Noam Rathaus (noamr)]

Hi

Thanks for the update

---
Thanks,
Noam Rathaus

On Apr 21, 2017 04:15, "Tyler Hicks" <email address hidden> wrote:

> As a note to any backporters, the original fix for this bug should
> include the following change as well:
>
> https://code.launchpad.net/~tyhicks/lightdm/guest-dir-
> perms/+merge/322906
>
> It is technically optional but definitely recommended.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1677924
>
> Title:
> Local privilege escalation via guest user login
>
> Status in Light Display Manager:
> Fix Released
> Status in Light Display Manager 1.18 series:
> Fix Released
> Status in Light Display Manager 1.20 series:
> Fix Released
> Status in Light Display Manager 1.22 series:
> Fix Released
> Status in lightdm package in Ubuntu:
> Fix Released
> Status in lightdm source package in Xenial:
> Fix Released
> Status in lightdm source package in Yakkety:
> Fix Released
> Status in lightdm source package in Zesty:
> Fix Released
>
> Bug description:
> It was discovered that a local attacker could watch for lightdm's
> guest-account script to create a /tmp/guest-XXXXXX file and then quickly
> create
> the lowercase representation of the guest user's home directory before
> lightdm
> could. This allowed the attacker to have control of the guest user's home
> directory and, subsequently, gain control of an arbitrary directory in
> the
> filesystem which could lead to privilege escalation.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/lightdm/+bug/1677924/+subscriptions
>

[Oliver Grawert (ogra)]

This security fix seems to have caused some fallout ... see bug 1733557

[Noam Rathaus (noamr)]

Sorry for being ignorant about this, but I don't know where to look

I looked at Bugzilla for Kernel.org and it doesn't show there

Where should I look?

On Sun, Apr 22, 2018 at 2:24 PM, Oliver Grawert <email address hidden> wrote:
> This security fix seems to have caused some fallout ... see bug 1733557
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1677924
>
> Title:
> Local privilege escalation via guest user login
>
> Status in Light Display Manager:
> Fix Released
> Status in Light Display Manager 1.18 series:
> Fix Released
> Status in Light Display Manager 1.20 series:
> Fix Released
> Status in Light Display Manager 1.22 series:
> Fix Released
> Status in lightdm package in Ubuntu:
> Fix Released
> Status in lightdm source package in Xenial:
> Fix Released
> Status in lightdm source package in Yakkety:
> Fix Released
> Status in lightdm source package in Zesty:
> Fix Released
>
> Bug description:
> It was discovered that a local attacker could watch for lightdm's
> guest-account script to create a /tmp/guest-XXXXXX file and then quickly create
> the lowercase representation of the guest user's home directory before lightdm
> could. This allowed the attacker to have control of the guest user's home
> directory and, subsequently, gain control of an arbitrary directory in the
> filesystem which could lead to privilege escalation.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/lightdm/+bug/1677924/+subscriptions

--

Thanks,
Noam Rathaus
Beyond Security

PGP Key ID: 7EF920D3C045D63F (Exp 2019-03)

[Seth Arnold (seth-arnold)]

Noam, ogra's comment on bug 1733557 is for: https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1733557

It automatically gets hyperlinked when viewing https://bugs.launchpad.net/ubuntu/+source/lightdm/+bug/1677924 directly.

Thanks

[Tyler Hicks (tyhicks)]

@ogra it isn't obvious how the fix for this bug could have caused bug 1733557. Can you elaborate?