pkexec information disclosure vulnerability

[Dan Rosenberg]

Binary package hint: policykit-1

pkexec is vulnerable to a minor information disclosure vulnerability that allows an attacker to verify whether or not arbitrary files exist, violating directory permissions. I reproduced the issue on my Karmic installation as follows:

$ mkdir secret
$ sudo chown root:root secret
$ sudo chmod 400 secret
$ sudo touch secret/hidden
$ pkexec /home/drosenbe/secret/hidden
(password prompt)
$ pkexec /home/drosenbe/secret/doesnotexist
Error getting information about /home/drosenbe/secret/doesnotexist: No such file or directory

I've attached a simple patch that resolves the issue by using access() to check whether or not the user has permission to verify the existence of the file before calling stat() on it.

[Dan Rosenberg (dan-j-rosenberg)]

Come to think of it, please ignore that patch. A determined attacker could exploit the race condition between the access() and stat() calls. I'll revisit this and produce a better patch within the next couple of days.

[Kees Cook (kees)]

As this is a relatively minor information disclosure, do you mind me making this report public?

[Dan Rosenberg (dan-j-rosenberg)]

Created an attachment (id=33901)
Patch for pkexec info disclosure

pkexec is vulnerable to a minor information disclosure vulnerability that allows an attacker to verify whether or not arbitrary files exist, violating directory permissions. I reproduced the issue on my Karmic installation as follows:

$ mkdir secret
$ sudo chown root:root secret
$ sudo chmod 400 secret
$ sudo touch secret/hidden
$ pkexec /home/drosenbe/secret/hidden
(password prompt)
$ pkexec /home/drosenbe/secret/doesnotexist
Error getting information about /home/drosenbe/secret/doesnotexist: No such file or directory

I've attached my patch for the issue. I replaced the stat() call entirely with access() using F_OK, so rather than check that the target exists, pkexec now checks if the user has permission to verify the existence of the program. There might be another way of doing this, such as chdir()'ing to the parent directory of the target and calling lstat(), but this seemed like more code than necessary to prevent such a minor problem. I see no reason to allow pkexec to execute targets that are not accessible to the executing user because of directory permissions. This is such a limited use case anyway that this doesn't really affect functionality.

[Dan Rosenberg (dan-j-rosenberg)]

New patch added. I see no reason to allow pkexec to execute targets that are not accessible to the executing user because of directory permissions. This is such a limited use case anyway that this doesn't really affect functionality.

I replaced the stat() call entirely with access() using F_OK, so rather than check that the target exists, pkexec now checks if the user has permission to verify the existence of the program. There might be another way of doing this, such as chdir()'ing to the parent directory of the target and calling lstat(), but this seemed like more code than necessary to prevent such a minor problem.

[James Westby (james-w)]

Hi Dan,

Thanks for looking at this. It would be great if you could take this issue
to the developers of the software at

  https://bugs.freedesktop.org/

and discuss the patch with them.

I would be happy to do this for you, but it would be much more efficient for
you to do it.

Thanks,

James

[James Westby (james-w)]

https://bugs.freedesktop.org/enter_bug.cgi?product=PolicyKit&short_desc=pkexec%20information%20disclosure%20vulnerability&long_desc=Originally%20reported%20at:%0A%20%20https://bugs.edge.launchpad.net/bugs/532852%0A%0ABinary%20package%20hint:%20policykit-1%0A%0Apkexec%20is%20vulnerable%20to%20a%20minor%20information%20disclosure%20vulnerability%20that%20allows%20an%20attacker%20to%20verify%20whether%20or%20not%20arbitrary%20files%20exist,%20violating%20directory%20permissions.%20%20I%20reproduced%20the%20issue%20on%20my%20Karmic%20installation%20as%20follows:%0A%0A$%20mkdir%20secret%0A$%20sudo%20chown%20root:root%20secret%0A$%20sudo%20chmod%20400%20secret%0A$%20sudo%20touch%20secret/hidden%0A$%20pkexec%20/home/drosenbe/secret/hidden%0A(password%20prompt)%0A$%20pkexec%20/home/drosenbe/secret/doesnotexist%0AError%20getting%20information%20about%20/home/drosenbe/secret/doesnotexist:%20No%20such%20file%20or%20directory%0A%0AI've%20attached%20a%20simple%20patch%20that%20resolves%20the%20issue%20by%20using%20access()%20to%20check%20whether%20or%20not%20the%20user%20has%20permission%20to%20verify%20the%20existence%20of%20the%20file%20before%20calling%20stat()%20on%20it.

is a URL that launchpad just suggested you use to file the bug
directly.

  http://tinyurl.com/yczgz4u

is the shorter version of that.

Thanks,

James

[Dan Rosenberg (dan-j-rosenberg)]

I filed a bug entry upstream, and included an updated version of the patch (only change was removing the now-unnecessary stat struct declaration):

https://bugs.freedesktop.org/show_bug.cgi?id=26982

[James Westby (james-w)]

On Tue, 09 Mar 2010 19:21:13 -0000, Dan Rosenberg <email address hidden> wrote:
> I filed a bug entry upstream, and included an updated version of the
> patch (only change was removing the now-unnecessary stat struct
> declaration):

Thanks Dan.

James

[Zeuthen (zeuthen)]

Nice catch, committed.

http://cgit.freedesktop.org/PolicyKit/commit/?id=14bdfd816512a82b1ad258fa143ae5faa945df8a

Thanks.

[Dan Rosenberg (dan-j-rosenberg)]

The fix has been signed off and committed upstream:

http://cgit.freedesktop.org/PolicyKit/commit/?id=14bdfd816512a82b1ad258fa143ae5faa945df8a

Kees, do issues this minor typically get CVE's? Your call.

[Kees Cook (kees)]

I'll leave it up to oss-security about getting a CVE assigned. Emailing them now.

[Dan Rosenberg (dan-j-rosenberg)]

CVE-2010-0750

[Nigel Babu (nigelbabu)]

This bug wasn't closed from changelog, so I'll just manually close it here

policykit-1 (0.96-2) unstable; urgency=medium

  * Urgency medium, just two small, but important bug fixes.
  * Add 00git-pkexec-information-disclosure.patch: Fix information disclosure
    vulnerability that allows an attacker to verify whether or not arbitrary
    files exist, violating directory permissions.
  * 00git-fix-error-freeing.patch: Fix crash when calling CheckAuthorization()
    with an invalid PID. (LP: #540464)

 -- Martin Pitt <email address hidden> Fri, 09 Apr 2010 12:09:53 +0200

[Martin Pitt (pitti)]

policykit-1 was introduced in Karmic, closing the tasks for earlier releases.

[Martin Pitt (pitti)]

Security team,

the upstream fix is straightforward enough. Do you need me to prepare a debdiff, or do you want to apply/upload this yourself?

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. karmic has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against karmic is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.