Insecure use of temp files

[Loïc Minier]

Binary package hint: flash-kernel

        Hi folks

While reviewing a recent patch in Debian #596889, I noticed that flash-kernel already had other instances of this apparently insecure construct:

> + tmp=$(tempfile)
> + cat $kfile >> $tmp
> + mkimage -A arm -O linux -T kernel -C none -a 0x60008000 \
> + -e 0x60008000 -n "Linaro Kernel" -d $tmp $tmp.uboot \
> + >&2 1>/dev/null

mkimage takes the kernel from $tmp and writes it to its first arg, $tmp.uboot. There is a window where an attacker can create a tmp.uboot symlink pointing to a file of his choice making this a probably low priority local denial of service vulnerability. Note that flash-kernel is called for each kernel upgrade and runs as root to install the new kernel.

I checked flash-kernel 1.6 and it doesn't call mkimage but is affected by a different type of tempfile abuse:

                tmp=$(tempfile)
                printf "Flashing kernel: " >&2
                (
                        sercomm_header $(expr $kfilesize + 16)
                        dd if=$kfile of=$tmp bs=$ksize1 count=1 2>/dev/null
                        nslu2_swap $tmp
                        sercomm_header 131072
                        dd if=$kfile of=$tmp ibs=$ksize1 skip=1 2>/dev/null
                        nslu2_swap $tmp
                        rm -f $tmp
                ) > "$kmtd" || error "failed."
                echo "done." >&2
                printf "Flashing initramfs: " >&2
                dd if=$ifile of=$tmp ibs=$(($imtdsize - 16)) conv=sync 2>/dev/null

Note how the tempfile is created, truncated by dd, truncated by dd a second time, removed, and then created again in this last dd call I quoted above.

   Cheers,

[Jamie Strandboge (jdstrand)]

This was fixed in 2.33 in Debian, but still not in Ubuntu. Since that is public, I am marking this bug as public.

[Robie Basak (racb)]

This isn't just a DoS. Isn't it a trojanable kernel? I put more detail as to why in bug #1003198 before I realised I was creating a dupe.

[dann frazier (dannf)]

On Wed, May 23, 2012 at 12:55:38AM -0000, Robie Basak wrote:
> This isn't just a DoS. Isn't it a trojanable kernel? I put more detail
> as to why in bug #1003198 before I realised I was creating a dupe.

I think the in-kernel symlink protection limits the impact to a
DoS as long as your are running an Ubuntu kernel. See #959422.

[Marc Deslauriers (mdeslaur)]

Replacing the destination file with a symlink would be blocked by the kernel, but creating an empty file would probably result in the kernel being trojanable.

This needs to be fixed. Best way would be to create a temp directory and work inside of it.

[Oliver Grawert (ogra)]

i belive with the sync of version 3.0~rc4 from debian this is fixed for quantal

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. natty has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against natty is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. oneiric has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against oneiric is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release