lens-bar-keynavigation periodically writes to /tmp/wut.png

Bug #1051921 reported by Jean-Paul Calderone on 2012-09-17
22
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Unity
Fix Released
Medium
Stephen M. Webb
5.0
Fix Released
Medium
Stephen M. Webb
unity (Ubuntu)
Low
Stephen M. Webb
Precise
Low
Stephen M. Webb

Bug Description

[Impact]

 * Style::SquareButton writes a small png to /tmp/wut.png
 * If a user creates /tmp/wut.png as a symlink to some file on the system writeable by the owner of the unity process, then he/she can destroy that file.

[Test Case]

 * log out
 * log in with the upgraded package
 * open the terminal application using control-alt-T, ensure the terminal is focused
 * invoke the HUD by pressing the Alt key and typing f (the HUD menu selection 'drop
   down' must appear to trigger the png file write)
 * check for presence of "/tmp/wut.png"

[Regression Potential]

 * n/a

[Other Info]

 * Marc Deslauriers from the security team said it isn't a problem on Ubuntu because we have symlink restrictions (in this case part of the Yama LSM [1]).

 * We believe, not everyone is necessarily running Yama LSM.

Related branches

Marc Deslauriers (mdeslaur) wrote :

No security impact because of the symlink restrictions in Ubuntu....it's just...bad coding.

security vulnerability: yes → no
visibility: private → public
Paul Tagliamonte (paultag) wrote :

Verified by a trusted friend, and Unity has the following line from the diff ref'd above:

    cairo_surface_write_to_png(cairo_get_target(cr), "/tmp/wut.png");

Seriously unclean. Also, unsafe usage of tmp.

Changed in unity (Ubuntu):
importance: Undecided → Low
status: New → Triaged
Sven Mueller (smu-u) wrote :

The symlink restrictions are solely in the kernel, which people might have to replace for various reasons. In other words: It might not be a security issue on plain - unmodified - Ubuntu, but it is still a security issue.
Just sayin'

Changed in unity (Ubuntu Precise):
status: New → Triaged
importance: Undecided → Low
Stephen M. Webb (bregma) on 2013-08-15
Changed in unity:
milestone: none → 7.1.2
status: New → Triaged
importance: Undecided → Medium
Stephen M. Webb (bregma) on 2013-08-15
Changed in unity:
status: Triaged → In Progress
Changed in unity (Ubuntu):
status: Triaged → In Progress
Changed in unity (Ubuntu Precise):
status: Triaged → In Progress
Changed in unity:
assignee: nobody → Stephen M. Webb (bregma)
Changed in unity (Ubuntu):
assignee: nobody → Stephen M. Webb (bregma)
Changed in unity (Ubuntu Precise):
assignee: nobody → Stephen M. Webb (bregma)
PS Jenkins bot (ps-jenkins) wrote :

Fix committed into lp:unity at revision None, scheduled for release in unity, milestone 7.1.1

Changed in unity:
status: In Progress → Fix Committed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package unity - 7.1.0+13.10.20130816.3-0ubuntu1

---------------
unity (7.1.0+13.10.20130816.3-0ubuntu1) saucy; urgency=low

  [ Michal Hruby ]
  * Make sure we emit row_added signals for all rows present in a model
    when changing a model Model::SetModel(). (LP: #1212580)

  [ Andrew McCarthy ]
  * added photo lens shortcut to the shortcuts hint window (lp:
    #1069644). (LP: #1069644)

  [ Stephen M. Webb ]
  * added photo lens shortcut to the shortcuts hint window (lp:
    #1069644). (LP: #1069644)
  * removed debug output thatcould cause a potential security problem
    (lp: #1051921). (LP: #1051921)

  [ Nick Dedekind ]
  * Don't re-add the rows for filters and categories if the model
    changes.
  * Fixed duplicate categories in scope caused by full resync on model
    change. (LP: #1212945)

  [ Chris Townsend ]
  * Fix issue where the same app on different workspaces would not allow
    alt-tab to work properly when trying to switch to the last used app
    on the same workspace. (LP: #1211261)

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 3473
 -- Ubuntu daily release <email address hidden> Fri, 16 Aug 2013 11:47:59 +0000

Changed in unity (Ubuntu):
status: In Progress → Fix Released
description: updated
tags: added: precise
Ritesh Khadgaray (khadgaray) wrote :
description: updated
description: updated
Stephen M. Webb (bregma) on 2013-08-20
description: updated
Paul Tagliamonte (paultag) wrote :

Thanks, Y'all!

Changed in unity (Ubuntu Precise):
status: In Progress → Fix Committed
Iain Lane (laney) wrote :

Don't see there is anything for sponsors to do here (it's merged in precise's branch already).

Stephen M. Webb (bregma) on 2013-10-10
Changed in unity:
milestone: 7.1.2 → 7.1.1
status: Fix Committed → Fix Released
Mark Russell (marrusl) wrote :

Any idea when this will be SRU'd to Precise? It's been merged for a few months now.

John Kim (kotux) on 2014-02-16
Changed in unity (Ubuntu Precise):
status: Fix Committed → Fix Released
Margarita Manterola (marga-9) wrote :

Actually, it doesn't seem to be fixed in Precise. This is the latest changelog entry of the current Precise version:

unity (5.20.0-0ubuntu3) precise-proposed; urgency=low

  * Add initial support for pointer barriers with xinput2 api. (LP: #1242633)
    - Fallback to xfixes stays available.
  * Bump dependencies to compile with both pointer barriers implementations.

 -- Maarten Lankhorst <email address hidden> Thu, 05 Sep 2013 11:58:32 +0200

It's 0ubuntu3 as the one in the proposed patch, but it's actually a completely different entry, referencing a different bug.

Changed in unity (Ubuntu Precise):
status: Fix Released → Triaged
Margarita Manterola (marga-9) wrote :

As can be seen in http://bazaar.launchpad.net/~unity-team/unity/5.0/changes/2425?start_revid=2425, the commit was submitted in revision 2423, but there have been no Unity 5 releases after that.

Is there going to be a last Unity 5 release, or is 5.20 the last one?

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers