StateSaver serializes potentially sensitive data under /tmp, doesn’t use O_EXCL

[Olivier Tilloy]

This issue applies to desktop only, where StateSaver serializes data in files under /tmp. On devices, confined applications have their own TMPDIR, which makes it a non-issue, as far as I understand it.

StateSaver uses QSettings under the hood to persist data on disk, which issues a plain QFile::open(QFile::ReadWrite) call to open the file, which does not set the O_EXCL flag.

This makes it vulnerable to symlink attacks.

Using QTemporaryFile would solve this issue, but it might not be easy to do with QSettings.

[Marc Deslauriers (mdeslaur)]

from modules/Ubuntu/Components/plugin/statesaverbackend_p.cpp:

    m_archive = new QSettings(QString("%1/%2.state")
                              .arg(QStandardPaths::standardLocations(QStandardPaths::TempLocation)[0])
                              .arg(applicationName), QSettings::NativeFormat);

QStandardPaths::TempLocation is /tmp by default.

This gets CVE-2014-1420

[Zsombor Egri (zsombi)]

Yes, the temp folder has been used until we get a proper path for it. Seems we can use XDG_RUNTIME_DIR i.e. QStandardPaths::RuntimeLocation for it as it will be cleared on reboot same way as /tmp is.

[Zsombor Egri (zsombi)]

I'm afraid we are not gonna be able to fix this for Trusty, only for Utopic. We have been asked not to back port toolkit to Trusty.

[Olivier Tilloy (osomon)]

Then the status should probably be "Won’t Fix", not "Invalid".

[Zsombor Egri (zsombi)]

I'm sorry, Olivier, I cannot set it to "Won't fix". It doesn't let me do that.

[Marc Deslauriers (mdeslaur)]

Not fixing this for trusty is not an option. This package is in the main pocket, which means it is officially supported for the life of the LTS release, including security updates.

If someone can confirm that the fix in the merge request above also applies to Trusty, the security team can push out the fix.

[PS Jenkins bot (ps-jenkins)]

Fix committed into lp:~ubuntu-sdk-team/ubuntu-ui-toolkit/staging at revision None, scheduled for release in ubuntu-ui-toolkit, milestone Unknown

[Zsombor Egri (zsombi)]

Marc, as you said, Trusty has this, and therefore the fix also applies to Trusty too.

[Marc Deslauriers (mdeslaur)]

This was fixed in ubuntu-ui-toolkit (1.1.1188+14.10.20140813.4-0ubuntu1)
by http://bazaar.launchpad.net/~ubuntu-sdk-team/ubuntu-ui-toolkit/staging/revision/1182