Ubuntu

pkexec information disclosure vulnerability

Reported by Dan Rosenberg on 2010-03-05
264
This bug affects 1 person
Affects Status Importance Assigned to Milestone
PolicyKit
Fix Released
Medium
policykit-1 (Ubuntu)
Low
Unassigned
Hardy
Undecided
Unassigned
Intrepid
Undecided
Unassigned
Jaunty
Undecided
Unassigned
Karmic
Low
Unassigned
Lucid
Low
Unassigned

Bug Description

Binary package hint: policykit-1

pkexec is vulnerable to a minor information disclosure vulnerability that allows an attacker to verify whether or not arbitrary files exist, violating directory permissions. I reproduced the issue on my Karmic installation as follows:

$ mkdir secret
$ sudo chown root:root secret
$ sudo chmod 400 secret
$ sudo touch secret/hidden
$ pkexec /home/drosenbe/secret/hidden
(password prompt)
$ pkexec /home/drosenbe/secret/doesnotexist
Error getting information about /home/drosenbe/secret/doesnotexist: No such file or directory

I've attached a simple patch that resolves the issue by using access() to check whether or not the user has permission to verify the existence of the file before calling stat() on it.

CVE References

Dan Rosenberg (dan-j-rosenberg) wrote :
Dan Rosenberg (dan-j-rosenberg) wrote :

Come to think of it, please ignore that patch. A determined attacker could exploit the race condition between the access() and stat() calls. I'll revisit this and produce a better patch within the next couple of days.

Kees Cook (kees) wrote :

As this is a relatively minor information disclosure, do you mind me making this report public?

Kees Cook (kees) on 2010-03-08
visibility: private → public
Changed in policykit-1 (Ubuntu):
status: New → Confirmed
importance: Undecided → Low
tags: added: patch

Created an attachment (id=33901)
Patch for pkexec info disclosure

pkexec is vulnerable to a minor information disclosure vulnerability that allows an attacker to verify whether or not arbitrary files exist, violating directory permissions. I reproduced the issue on my Karmic installation as follows:

$ mkdir secret
$ sudo chown root:root secret
$ sudo chmod 400 secret
$ sudo touch secret/hidden
$ pkexec /home/drosenbe/secret/hidden
(password prompt)
$ pkexec /home/drosenbe/secret/doesnotexist
Error getting information about /home/drosenbe/secret/doesnotexist: No such file or directory

I've attached my patch for the issue. I replaced the stat() call entirely with access() using F_OK, so rather than check that the target exists, pkexec now checks if the user has permission to verify the existence of the program. There might be another way of doing this, such as chdir()'ing to the parent directory of the target and calling lstat(), but this seemed like more code than necessary to prevent such a minor problem. I see no reason to allow pkexec to execute targets that are not accessible to the executing user because of directory permissions. This is such a limited use case anyway that this doesn't really affect functionality.

Dan Rosenberg (dan-j-rosenberg) wrote :

New patch added. I see no reason to allow pkexec to execute targets that are not accessible to the executing user because of directory permissions. This is such a limited use case anyway that this doesn't really affect functionality.

I replaced the stat() call entirely with access() using F_OK, so rather than check that the target exists, pkexec now checks if the user has permission to verify the existence of the program. There might be another way of doing this, such as chdir()'ing to the parent directory of the target and calling lstat(), but this seemed like more code than necessary to prevent such a minor problem.

James Westby (james-w) wrote :

Hi Dan,

Thanks for looking at this. It would be great if you could take this issue
to the developers of the software at

  https://bugs.freedesktop.org/

and discuss the patch with them.

I would be happy to do this for you, but it would be much more efficient for
you to do it.

Thanks,

James

Dan Rosenberg (dan-j-rosenberg) wrote :

I filed a bug entry upstream, and included an updated version of the patch (only change was removing the now-unnecessary stat struct declaration):

https://bugs.freedesktop.org/show_bug.cgi?id=26982

On Tue, 09 Mar 2010 19:21:13 -0000, Dan Rosenberg <email address hidden> wrote:
> I filed a bug entry upstream, and included an updated version of the
> patch (only change was removing the now-unnecessary stat struct
> declaration):

Thanks Dan.

James

The fix has been signed off and committed upstream:

http://cgit.freedesktop.org/PolicyKit/commit/?id=14bdfd816512a82b1ad258fa143ae5faa945df8a

Kees, do issues this minor typically get CVE's? Your call.

Nigel Babu (nigelbabu) on 2010-04-01
tags: added: patch-accepted-upstream
removed: patch
Kees Cook (kees) wrote :

I'll leave it up to oss-security about getting a CVE assigned. Emailing them now.

Kees Cook (kees) on 2010-04-01
Changed in policykit-1 (Ubuntu Karmic):
status: New → Confirmed
Changed in policykit-1 (Ubuntu Lucid):
milestone: none → ubuntu-10.04
Changed in policykit-1 (Ubuntu Intrepid):
status: New → Confirmed
Changed in policykit-1 (Ubuntu Hardy):
status: New → Confirmed
Changed in policykit-1 (Ubuntu Jaunty):
status: New → Confirmed

CVE-2010-0750

Nigel Babu (nigelbabu) wrote :

This bug wasn't closed from changelog, so I'll just manually close it here

policykit-1 (0.96-2) unstable; urgency=medium

  * Urgency medium, just two small, but important bug fixes.
  * Add 00git-pkexec-information-disclosure.patch: Fix information disclosure
    vulnerability that allows an attacker to verify whether or not arbitrary
    files exist, violating directory permissions.
  * 00git-fix-error-freeing.patch: Fix crash when calling CheckAuthorization()
    with an invalid PID. (LP: #540464)

 -- Martin Pitt <email address hidden> Fri, 09 Apr 2010 12:09:53 +0200

Changed in policykit-1 (Ubuntu Lucid):
status: Confirmed → Fix Released
Martin Pitt (pitti) wrote :

policykit-1 was introduced in Karmic, closing the tasks for earlier releases.

Changed in policykit-1 (Ubuntu Hardy):
status: Confirmed → Invalid
Changed in policykit-1 (Ubuntu Intrepid):
status: Confirmed → Invalid
Changed in policykit-1 (Ubuntu Karmic):
status: Confirmed → Triaged
Changed in policykit-1 (Ubuntu Jaunty):
status: Confirmed → Invalid
Martin Pitt (pitti) wrote :

Security team,

the upstream fix is straightforward enough. Do you need me to prepare a debdiff, or do you want to apply/upload this yourself?

Steve Beattie (sbeattie) on 2010-06-24
Changed in policykit:
importance: Undecided → Unknown
status: New → Unknown
Changed in policykit-1 (Ubuntu Karmic):
importance: Undecided → Low
Changed in policykit:
importance: Unknown → Medium
status: Unknown → Fix Released
Changed in policykit:
importance: Medium → Unknown
Changed in policykit:
importance: Unknown → Medium
Jamie Strandboge (jdstrand) wrote :

Thank you for reporting this bug to Ubuntu. karmic has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against karmic is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

Changed in policykit-1 (Ubuntu Karmic):
status: Triaged → Won't Fix
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers

Bug attachments

Remote bug watches

Bug watches keep track of this bug in other bug trackers.