Shell expansion may allow privilege boundary crossing
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
acpid |
New
|
Undecided
|
Unassigned | ||
acpid (Ubuntu) |
Fix Released
|
Medium
|
Tyler Hicks |
Bug Description
Oliver-Tobias Ripka reported a vulnerability in /etc/acpi/
that could allow an attacker to execute arbitrary code as the user that
is logged into the current X session. The prerequisites for the attack
are as follows:
1.) The attacker must be able to run an application on the system.
2.) A power management daemon cannot be running. See $PMS in
powerbtn.sh for the list of known daemons.
3.) powerbtn.sh must be triggered. This may happen by pressing a power
button in a bare-metal installation or by virsh shutdown in a
virtualized environment.
Oliver-Tobias pointed us to this excerpt from line 40 of powerbtn.sh:
su - $XUSER -c "eval $(echo -n 'export '; cat /proc/$(pidof
kded4)/environ |tr '\0' '\n'|grep DBUS_SESSION_
org.kde.kded"
$(pidof kded4) returns the pid of any process(es) named kded4. Due to command
expansion, cat /proc/$(pidof kded4)/environ is ran as root, allowing the
environ of any process, owned by any user, to be successfully read.
The attacker may be running a "fake" kded4 binary which has a malicious
DBUS_SESSION_
shell commands that would be expanded as $XUSER. This opens up the
possibility of the attacker running code as $XUSER. The prerequisites
listed above must be met in order for the vulnerable code to be
exploited.
affects: | acpi-support (Ubuntu) → acpid (Ubuntu) |
description: | updated |
description: | updated |
description: | updated |
sbeattie suggested that su command could be changed to the following:
su - $XUSER -c 'eval $(echo -n "export "; grep -z DBUS_SESSION_ BUS_ADDRESS /proc/$(pidof kded4)/environ); qdbus org.kde.kded'
In the attack scenario, this causes the grep command to fail due to $XUSER not having permission to read /proc/$(pidof kded4)/environ. However, we may want to clean this up a little more because qdbus is still executed. sbeattie also pointed out that $(pidof kded4) returning multiple pids could be problematic.