Systemd v228 local root exploit

Post by lmm » Tue, Jan 24, 2017, 11:32 AM UTC

benmmurphy wrote: post #30

baq wrote: post #26

here's the fix: https://github.com/systemd/systemd/commit/06eeacb6fe029804f2... questions to the local experts: 1) would using a differently designed open() api prevent the issue? 2) would not using C to write systemd prevent the issue? specifically, would using rust, ocaml, ats or ada prevent the issue?

2) maybe. mode_t is unsigned and MODE_INVALID was defined as: #define MODE_INVALID ((mode_t) -1) and the problem was in a check: fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, mode > 0 ? mode : 0644); so maybe the author thought MODE_INVALID the other thing is maybe in a safe language you would use an Option/Maybe type here instead of a plain mode_t type.

Post by jwilk » Tue, Jan 24, 2017, 11:32 AM UTC

berdario wrote: post #29

bkor wrote: post #25

Earlier quoted context omitted.

CVE is an invite only system, applied to just a few projects. See e.g. https://cve.mitre.org/cve/data_sources_product_coverage.html . Generally you need to know someone to get such an id. If you have a bug in some github project you cannot request a CVE for that. If a CVE is reported you'd usually include that in the commit. But that's not the same as every security bug should have a CVE. Often way easier to just fix…

I don't know any insider, but obtaining a CVE was not really difficult: http://seclists.org/oss-sec/2016/q3/231 (and it was not even my project... I just reported the bug) Now the workflow changed a bit, in the link that you shared in fact it says "For open source software products not listed below, request a CVE ID through the Distributed Weakness Filing Project CNA." which is just an easy-to-fill Google form. Not s…

Post by efaref » Tue, Jan 24, 2017, 11:48 AM UTC

x0 wrote: post #14

bergers89 wrote: post #7

yeah, awesome, i enjoy this systemD shit show. Linux is so doomed.

You're right. Ever since distros made systemd default, computers all over the world have been catching fire, exploding, shooting jets of lava from their headphone jacks. It's the end times

Post by feld » Tue, Jan 24, 2017, 11:57 AM UTC

bkor wrote: post #25

implr wrote: post #4

>We would like to see that systemd upstream retrieves CVE's themself for their own bugs, even if its believed that its just a local DoS. So not only they didn't notice this was exploitable, they also seem to think that a local DoS is not enough for a CVE or a public report. Excellent.

CVE is an invite only system, applied to just a few projects. See e.g. https://cve.mitre.org/cve/data_sources_product_coverage.html . Generally you need to know someone to get such an id. If you have a bug in some github project you cannot request a CVE for that. If a CVE is reported you'd usually include that in the commit. But that's not the same as every security bug should have a CVE. Often way easier to just fix…

Post by ioquatix » Tue, Jan 24, 2017, 11:58 AM UTC

implr wrote: post #4

>We would like to see that systemd upstream retrieves CVE's themself for their own bugs, even if its believed that its just a local DoS. So not only they didn't notice this was exploitable, they also seem to think that a local DoS is not enough for a CVE or a public report. Excellent.