Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Systemd v228 local root exploit

openwall.com

Post reply on HN
Print view View original

61–70 of 162 posts

Re: Systemd v228 local root exploit

#61

Post by bkor »

berdario wrote: post #29
bkor wrote: post #25

Earlier quoted context omitted.

CVE is an invite only system, applied to just a few projects. See e.g. https://cve.mitre.org/cve/data_sources_product_coverage.html . Generally you need to know someone to get such an id. If you have a bug in some github project you cannot request a CVE for that. If a CVE is reported you'd usually include that in the commit. But that's not the same as every security bug should have a CVE. Often way easier to just fix…

I don't know any insider, but obtaining a CVE was not really difficult: http://seclists.org/oss-sec/2016/q3/231 (and it was not even my project... I just reported the bug) Now the workflow changed a bit, in the link that you shared in fact it says "For open source software products not listed below, request a CVE ID through the Distributed Weakness Filing Project CNA." which is just an easy-to-fill Google form. Not s…

If you go to https://cve.mitre.org/ it has a link "Request a CVE ID" which IMO explains that it is only for some products, not all. Alternatively there's also a weblink below it which want GPG key, etc. Alternatively you can email some mailing list, but I don't see where this is documented.

The complaint was that the CVE should've 1) been included in the commit 2) been made. IMO the entire thing is confusing.

Also like to repeat: it's super nice that things are reported and have a CVE. But that doesn't mean every security commit will be seen as related to security.

I'm pretty sure I've seen enough interesting commits in gdk-pixbuf: https://git.gnome.org/browse/gdk-pixbuf/commit/?id=49dcd2d58...

Re: Systemd v228 local root exploit

#62

Post by gravypod »

scrollaway wrote: post #49
ioquatix wrote: post #39

Earlier quoted context omitted.

Did you know that polkit, the systemd replacement of sudo, uses JavaScript to validate permissions? This was the response: https://lists.freedesktop.org/archives/systemd-devel/2016-De... systemd is a bomb waiting to go off, IMHO.

> polkit, the systemd replacement of sudo I honestly do not understand how you can feel comfortable making judgement calls about projects when you cannot even accurately state their function.

"Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems."

Calling it the sudo for UIs seems reasonable. It lets you manage the permission level of the UI you're using.

Does it do something else?

Re: Systemd v228 local root exploit

#63

Post by SixSigma »

throwawayish wrote: post #15
implr wrote: post #4

>We would like to see that systemd upstream retrieves CVE's themself for their own bugs, even if its believed that its just a local DoS. So not only they didn't notice this was exploitable, they also seem to think that a local DoS is not enough for a CVE or a public report. Excellent.

I'm not aware of server or desktop OS that isn't generally vulnerable to local DoS.

https://en.wikipedia.org/wiki/Burroughs_large_systems

Re: Systemd v228 local root exploit

#64

Post by lordlimecat »

gravypod wrote: post #62
scrollaway wrote: post #49

Earlier quoted context omitted.

> polkit, the systemd replacement of sudo I honestly do not understand how you can feel comfortable making judgement calls about projects when you cannot even accurately state their function.

" Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. " Calling it the sudo for UIs seems reasonable. It lets you manage the permission level of the UI you're using. Does it do something else?

Youre being too generous. GP's statement was,

"Did you know that polkit, the systemd replacement of sudo,"

He calls it a replacement of sudo which is is definitely not.

Re: Systemd v228 local root exploit

#65

Post by lmm »

tveita wrote: post #45
lmm wrote: post #32

Earlier quoted context omitted.

> maybe safe languages will let you do this explicit cast as well They will let you, but explicit casts are a red flag in code review.

So in other words it wouldn't have made a difference. A better type system gives you the option to enforce stricter checks to help you catch mistakes, but the same people with the same procedures would have written this bug in any language.

Not necessarily. If any unsafe constructs are locally visible during code review, and the language is such that unsafe constructs are rarely required, then it's much easier to give unsafe constructs a higher level of scrutiny that you can't afford to do in a language like C where unsafe things are pervasive and the same line can easily be safe in one context and unsafe in another.

Re: Systemd v228 local root exploit

#68

Post by grhmc »

KuiN wrote: post #22
implr wrote: post #4

>We would like to see that systemd upstream retrieves CVE's themself for their own bugs, even if its believed that its just a local DoS. So not only they didn't notice this was exploitable, they also seem to think that a local DoS is not enough for a CVE or a public report. Excellent.

This is the really concerning part. silently fixed in the upstream git is not at all an acceptable way to deal with serious security flaws in your product.

This is frequently how the linux kernel operates.

Re: Systemd v228 local root exploit

#69

Post by djsumdog »

tinus_hn wrote: post #67

Why does systemd have functionality to create files as root for unprivileged users anyway? What's the point?

I don't like systemd, but for the benefit of the doubt. One of the dangerous lines of code is in a touch_file function:

https://github.com/systemd/systemd/blob/ee735086f8670be1591f...

..and most init systems do have a legitimate use case for touching a file.

Re: Systemd v228 local root exploit

#70

Post by ioquatix »

scrollaway wrote: post #49
ioquatix wrote: post #39

Earlier quoted context omitted.

Did you know that polkit, the systemd replacement of sudo, uses JavaScript to validate permissions? This was the response: https://lists.freedesktop.org/archives/systemd-devel/2016-De... systemd is a bomb waiting to go off, IMHO.

> polkit, the systemd replacement of sudo I honestly do not understand how you can feel comfortable making judgement calls about projects when you cannot even accurately state their function.

Well, since this was the recommendation from one of the polkit contributors... I'm not exactly sure what you mean. Perhaps you can enlighten me with your wisdom.
Post reply on HN