snap userd's OpenURL method allows sandox escape

[James Henstridge]

snap userd's OpenURL implementation alters the value of $XDG_DATA_DIRS to include a directory controlled by the calling snap before calling /usr/bin/xdg-open:

https://github.com/snapcore/snapd/blob/7f678b92/usersession/userd/launcher.go#L109-L113

This allows the snap to control how the URL will be opened, including having executables provided by the snap run outside of confinement.

Attached is an example snap demonstrating the exploit. It works as follows:

1. the snap provides a single command plugging the desktop interface that calls "xdg-open help://whatever"

2. userd invokes the host system /usr/bin/xdg-open with $SNAP/usr/share/applications at the start of $XDG_DATA_DIRS.

3. under $SNAP/usr/share/applications, we have a yelp.desktop file whose Exec line points to an "outside-sandbox.sh" script shipped with the snap, and a mimeapps.list file to set it as the default handler for the "help:" scheme.

4. the "outside-sandbox.sh" script is executed without confinement and writes a file /tmp/foo.txt

This file can be seen in the host system /tmp rather than the snap's private /tmp, demonstrating that it was run outside the sandbox.

Note that this isn't restricted to the "help:" URI scheme: it's just more likely to succeed, since users are unlikely to override the default handler.

[James Henstridge (jamesh)]

The Snapcraft project used to build the exploit snap.

[Jamie Strandboge (jdstrand)]

Thanks James. snapd team, this will require a deb update, USN and cross-distro updates. I'll send a coordinating email.

[Seth Arnold (seth-arnold)]

Please use CVE-2020-11934 for this issue. Thanks.

[James Henstridge (jamesh)]

Attached is a patch to remove the offending code from userd. This does not include the packaging changes needed to release new snaps or debs.

[Jamie Strandboge (jdstrand)]

Marking the trusty task as "won't fix" per https://wiki.ubuntu.com/SecurityTeam/ESM/14.04#Exclusions where snapd is supported on 14.04 ESM insofar as enabling livepatch and cvescan (neither of which use this API).

[Launchpad Janitor (janitor)]

This bug was fixed in the package snapd - 2.45.1+20.04.2

---------------
snapd (2.45.1+20.04.2) focal-security; urgency=medium

  * SECURITY UPDATE: sandbox escape vulnerability via snapctl user-open
    (xdg-open)
    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
      variable modification when calling the system xdg-open. Patch
      thanks to James Henstridge
    - packaging/ubuntu-16.04/snapd.postinst: kill userd on upgrade so it
      may autostart on next use. Patch thanks to Michael Vogt
    - CVE-2020-11934
    - LP: #1880085

 -- Emilia Torino <email address hidden> Fri, 10 Jul 2020 10:59:20 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package snapd - 2.45.1+19.10.2

---------------
snapd (2.45.1+19.10.2) eoan-security; urgency=medium

  * SECURITY UPDATE: sandbox escape vulnerability via snapctl user-open
    (xdg-open)
    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
      variable modification when calling the system xdg-open. Patch
      thanks to James Henstridge
    - packaging/ubuntu-16.04/snapd.postinst: kill userd on upgrade so it
      may autostart on next use. Patch thanks to Michael Vogt
    - CVE-2020-11934
    - LP: #1880085

 -- Emilia Torino <email address hidden> Fri, 10 Jul 2020 10:57:06 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package snapd - 2.45.1+18.04.2

---------------
snapd (2.45.1+18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: sandbox escape vulnerability via snapctl user-open
    (xdg-open)
    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
      variable modification when calling the system xdg-open. Patch
      thanks to James Henstridge
    - packaging/ubuntu-16.04/snapd.postinst: kill userd on upgrade so it
      may autostart on next use. Patch thanks to Michael Vogt
    - CVE-2020-11934
    - LP: #1880085

 -- Emilia Torino <email address hidden> Fri, 10 Jul 2020 11:00:39 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package snapd - 2.45.1ubuntu0.2

---------------
snapd (2.45.1ubuntu0.2) xenial-security; urgency=medium

  * SECURITY UPDATE: sandbox escape vulnerability via snapctl user-open
    (xdg-open)
    - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
      variable modification when calling the system xdg-open. Patch
      thanks to James Henstridge
    - packaging/ubuntu-16.04/snapd.postinst: kill userd on upgrade so it
      may autostart on next use. Patch thanks to Michael Vogt
    - CVE-2020-11934
    - LP: #1880085

 -- Emilia Torino <email address hidden> Fri, 10 Jul 2020 10:40:52 -0300

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "0001-usersession-userd-do-not-modify-XDG_DATA_DIRS-when-c.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Launchpad Janitor (janitor)]

This bug was fixed in the package snapd - 2.46~pre1.gitaf15176

---------------
snapd (2.46~pre1.gitaf15176) groovy; urgency=medium

  * New git snapshot for the upcoming 2.46 release

 -- Michael Vogt <email address hidden> Fri, 07 Aug 2020 09:15:31 +0200

[Zygmunt Krynicki (zyga)]

This was released a while ago, the upstream task was stale.