Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Systemd-coredump: CVE-2022-4415: local information leak

openwall.com

Post reply on HN
Print view View original

1–10 of 52 posts

Re: Systemd-coredump: CVE-2022-4415: local information leak

#4

Post by _flux »

Quite disappointing someone would enable that kernel option without fully considering the ramifications :/.

Do some distributions use systemd-coredump by default? I not just learned about systemd-coredump and I'm wondering if it could be actually useful for develoment purposes; apport doesn't seem to be.

Re: Systemd-coredump: CVE-2022-4415: local information leak

#5

Post by rwmj »

The exploit is quite interesting. Initially I didn't believe there could be a problem -- after all, we have the source of "su" so who cares if we can see a coredump from it? However the exploit is that "su" reads normally hidden files like /etc/shadow into memory (or more likely PAM does) thus exposing the contents of these files like password hashes to the non-root user.

I wonder if it would be generally better for su/PAM to mark this data as non-dumpable (MADV_DONTDUMP), just for defence in depth. You could also imagine coredumps being uploaded in bug reports, unintentionally revealing sensitive data.

Re: Systemd-coredump: CVE-2022-4415: local information leak

#6

Post by rwmj »

_flux wrote: post #4

Quite disappointing someone would enable that kernel option without fully considering the ramifications :/. Do some distributions use systemd-coredump by default? I not just learned about systemd-coredump and I'm wondering if it could be actually useful for develoment purposes; apport doesn't seem to be.

I use systemd-coredump all the time on Fedora, it's pretty convenient. When a program crashes, run "coredumpctl gdb" to launch gdb on the latest coredump.

Re: Systemd-coredump: CVE-2022-4415: local information leak

#7

Post by nine_k »

dijit wrote: post #3

The normal way I use machines these days is that anyone with login access has some ability to become root. But anyone who is hosting shellboxes (including "bastion" hosts in ISO27001 environments): this is pretty serious.

Shouldn't a shell box just disable core dumps altogether?

Re: Systemd-coredump: CVE-2022-4415: local information leak

#8

Post by wizeman »

dijit wrote: post #3

The normal way I use machines these days is that anyone with login access has some ability to become root. But anyone who is hosting shellboxes (including "bastion" hosts in ISO27001 environments): this is pretty serious.

> The normal way I use machines these days is that anyone with login access has some ability to become root.

That is good, but you don't necessarily need login access to exploit this. You could exploit it via an RCE vulnerability in some other program, like the HTTP server or NTP client.

Post reply on HN