CLD-484 Details

Other IDs this deficiency may be known by:

Basic Information:

Version Specific Information:

Details:

=================================== Overview ===================================

Integer overflow in shadow 4.2.1 allows local users to gain privileges via
crafted input to newuidmap. 

================================ Initial Report ================================

From http://www.openwall.com/lists/oss-security/2016/07/19/6:

Date: Tue, 19 Jul 2016 11:39:15 +0200
From: Sebastian Krahmer 
To: oss-security@...ts.openwall.com
Cc: ebiederm@...ssion.com
Subject: subuid security patches for shadow package

Hi

The shadow package contains newuidmap and newgidmap suid
binaries in order to allow users to take advantage of the
userns feature of uid-mappings.

I added patches here:

https://bugzilla.suse.com/show_bug.cgi?id=979282

they consist of:

1) Removing getlogin() to find out about users.
   It relies on utmp, which is not a trusted base of info (group writable).

2) Cleaning up UID retrieval and computation. The 'long long' code was
   totally unclear to me, as the numbers are converted to ulong right
   afterwards anyway. Additionally there was a *int overflow*, which can be
   tested via 'newuidmap $$ 0 10000 -1' (given that 10000 is listed as allowed)
   which produces no error but tries to write large "count" values to the uid_map
   file. Kernel may check for overflows itself, but it should not be allowed
   by a suid binary to be written in the first place.

Theoretically theres also a TOCTOU issue in newuidmap, since the
st_uid fields of the stat on /proc/pid may change over time
(suid being executed), but to my analsysis such twists have no gain
for the attacker.

Patch should be tested by upstream, since I am not sure what the
getlogin() code (shared uids??) was about at all.

Sebastian

================================= Our Analysis =================================

----- Affected Products -----
Versions of shadow prior to 4.3.1 that have not had the patch from
https://github.com/shadow-maint/shadow/commit/1d5a926cc2d6078d23a96222b1ef3e558724dad1
applied are vulnerable. This includes shadow as originally packaged in Cucumber
Linux 1.0 and 1.1.

----- Scope and Impact of this Vulnerability -----
Allows for a local privilege escalation.

----- Fix for this Vulnerability -----
This vulnerability can be fixed by upgrading to shadow 4.3.1 or later, or
applying the patch from commit
https://github.com/shadow-maint/shadow/commit/1d5a926cc2d6078d23a96222b1ef3e558724dad1.

================================= Our Solution =================================

We have applied the aforementioned patch and rebuilt.