pt_chown arbitrary pts access via user namespace

Bug #1529486 reported by halfdog on 2015-12-27
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
glibc (Ubuntu)
Undecided
Adam Conrad

Bug Description

With Ubuntu Wily and earlier, /usr/lib/pt_chown was used to change ownership of slave pts devices in /dev/pts to the same uid holding the master file descriptor for the slave. This is done using the pt_chown SUID binary, which invokes the ptsname function on the master-fd, thus again performing a TIOCGPTN ioctl to get the slave pts number. Using the result from the ioctl, the pathname of the slave pts is constructed and chown invoked on it, see login/programs/pt_chown.c:

  pty = ptsname (PTY_FILENO);
  if (pty == NULL)
    ...
  /* Get the group ID of the special `tty' group. */
  p = getgrnam (TTY_GROUP);
  gid = p ? p->gr_gid : getgid ();

  /* Set the owner to the real user ID, and the group to that special
     group ID. */
  if (chown (pty, getuid (), gid) < 0)
    return FAIL_EACCES;

  /* Set the permission mode to readable and writable by the owner,
     and writable by the group. */
  if ((st.st_mode & ACCESSPERMS) != (S_IRUSR|S_IWUSR|S_IWGRP)
      && chmod (pty, S_IRUSR|S_IWUSR|S_IWGRP) < 0)
    return FAIL_EACCES;

  return 0;

The logic above is severely flawed, when there can be more than one master/slave pair having the same number and thus same name. But this condition can be easily created by creating an user namespace, mounting devpts with the newinstance option, create master and slave pts pairs until the number overlaps with a target pts outside the namespace on the host, where there is interest to gain ownership and then invoke pt_chown.

See http://www.halfdog.net/Security/2015/PtChownArbitraryPtsAccessViaUserNamespace/ for more information (User: InvitedOnly, Pass: QV4uLdKn, Sharing policy: see attachment).

# lsb_release -rd
Description: Ubuntu 15.10
Release: 15.10
# apt-cache policy libc-bin
libc-bin:
  Installed: 2.21-0ubuntu4
  Candidate: 2.21-0ubuntu4
  Version table:
 *** 2.21-0ubuntu4 0
        500 http://archive.ubuntu.com/ubuntu/ wily/main amd64 Packages
        100 /var/lib/dpkg/status

CVE References

halfdog (halfdog) wrote :
Changed in glibc (Ubuntu):
status: New → Confirmed
Seth Arnold (seth-arnold) wrote :

Thanks Halfdog; this is currently under active discussion elsewhere; the solution for Wily and previous releases is far from obvious.

Foundations team, it'd be fantastic to stop shipping the setuid root /usr/lib/pt_chown executable in Xenial.

Thanks

Adam Conrad (adconrad) on 2016-01-06
Changed in glibc (Ubuntu):
assignee: nobody → Adam Conrad (adconrad)
Seth Arnold (seth-arnold) wrote :
information type: Private Security → Public Security
Adam Conrad (adconrad) on 2016-04-30
Changed in glibc (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers

Bug attachments