AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-14 17:11:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
bba6da4e1b
glibc/sysdeps/unix/sysv/linux/grantpt.c

45 lines
1.0 KiB
C
Raw Normal View History

Prevent unintended file desriptor leak in grantpt. The pt_chown program is completely transparently called. It might not be able to live with the various file descriptors the program has open at the time of the call (e.g., under SELinux). Close all but the needed descriptor and connect stdin, stdout, and stderr with /dev/null. pt_chown shouldn't print anything when called to do real work.
2009-11-25 02:24:14 +00:00
#include <assert.h>
#include <ctype.h>
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <paths.h>
#include <stdlib.h>
#include <unistd.h>
Use <> brackets for not-cancel.h in sysdeps/unix/sysv/linux/grantpt.c.
2012-01-28 16:51:44 +00:00
#include <not-cancel.h>
Prevent unintended file desriptor leak in grantpt. The pt_chown program is completely transparently called. It might not be able to live with the various file descriptors the program has open at the time of the call (e.g., under SELinux). Close all but the needed descriptor and connect stdin, stdout, and stderr with /dev/null. pt_chown shouldn't print anything when called to do real work.
2009-11-25 02:24:14 +00:00
#include "pty-private.h"
CVE-2013-2207, BZ #15755: Disable pt_chown. The helper binary pt_chown tricked into granting access to another user's pseudo-terminal. Pre-conditions for the attack: * Attacker with local user account * Kernel with FUSE support * "user_allow_other" in /etc/fuse.conf * Victim with allocated slave in /dev/pts Using the setuid installed pt_chown and a weak check on whether a file descriptor is a tty, an attacker could fake a pty check using FUSE and trick pt_chown to grant ownership of a pty descriptor that the current user does not own. It cannot access /dev/pts/ptmx however. In most modern distributions pt_chown is not needed because devpts is enabled by default. The fix for this CVE is to disable building and using pt_chown by default. We still provide a configure option to enable hte use of pt_chown but distributions do so at their own risk.
2013-07-19 06:42:03 +00:00
#if HAVE_PT_CHOWN
Prevent unintended file desriptor leak in grantpt. The pt_chown program is completely transparently called. It might not be able to live with the various file descriptors the program has open at the time of the call (e.g., under SELinux). Close all but the needed descriptor and connect stdin, stdout, and stderr with /dev/null. pt_chown shouldn't print anything when called to do real work.
2009-11-25 02:24:14 +00:00
/* Close all file descriptors except the one specified. */
static void
close_all_fds (void)
{
Avoid local PLTs.
2009-11-25 02:47:26 +00:00
DIR *dir = __opendir ("/proc/self/fd");
Prevent unintended file desriptor leak in grantpt. The pt_chown program is completely transparently called. It might not be able to live with the various file descriptors the program has open at the time of the call (e.g., under SELinux). Close all but the needed descriptor and connect stdin, stdout, and stderr with /dev/null. pt_chown shouldn't print anything when called to do real work.
2009-11-25 02:24:14 +00:00
if (dir != NULL)
{
struct dirent64 *d;
Avoid local PLTs.
2009-11-25 02:47:26 +00:00
while ((d = __readdir64 (dir)) != NULL)
Prevent unintended file desriptor leak in grantpt. The pt_chown program is completely transparently called. It might not be able to live with the various file descriptors the program has open at the time of the call (e.g., under SELinux). Close all but the needed descriptor and connect stdin, stdout, and stderr with /dev/null. pt_chown shouldn't print anything when called to do real work.
2009-11-25 02:24:14 +00:00
if (isdigit (d->d_name[0]))
{
char *endp;
long int fd = strtol (d->d_name, &endp, 10);
if (*endp == '\0' && fd != PTY_FILENO && fd != dirfd (dir))
close_not_cancel_no_status (fd);
}
Avoid local PLTs.
2009-11-25 02:47:26 +00:00
__closedir (dir);
Prevent unintended file desriptor leak in grantpt. The pt_chown program is completely transparently called. It might not be able to live with the various file descriptors the program has open at the time of the call (e.g., under SELinux). Close all but the needed descriptor and connect stdin, stdout, and stderr with /dev/null. pt_chown shouldn't print anything when called to do real work.
2009-11-25 02:24:14 +00:00
int nullfd = open_not_cancel_2 (_PATH_DEVNULL, O_RDONLY);
assert (nullfd == STDIN_FILENO);
nullfd = open_not_cancel_2 (_PATH_DEVNULL, O_WRONLY);
assert (nullfd == STDOUT_FILENO);
__dup2 (STDOUT_FILENO, STDERR_FILENO);
}
}
CVE-2013-2207, BZ #15755: Disable pt_chown. The helper binary pt_chown tricked into granting access to another user's pseudo-terminal. Pre-conditions for the attack: * Attacker with local user account * Kernel with FUSE support * "user_allow_other" in /etc/fuse.conf * Victim with allocated slave in /dev/pts Using the setuid installed pt_chown and a weak check on whether a file descriptor is a tty, an attacker could fake a pty check using FUSE and trick pt_chown to grant ownership of a pty descriptor that the current user does not own. It cannot access /dev/pts/ptmx however. In most modern distributions pt_chown is not needed because devpts is enabled by default. The fix for this CVE is to disable building and using pt_chown by default. We still provide a configure option to enable hte use of pt_chown but distributions do so at their own risk.
2013-07-19 06:42:03 +00:00
# define CLOSE_ALL_FDS() close_all_fds()
#endif
Prevent unintended file desriptor leak in grantpt. The pt_chown program is completely transparently called. It might not be able to live with the various file descriptors the program has open at the time of the call (e.g., under SELinux). Close all but the needed descriptor and connect stdin, stdout, and stderr with /dev/null. pt_chown shouldn't print anything when called to do real work.
2009-11-25 02:24:14 +00:00
#include <sysdeps/unix/grantpt.c>
Reference in New Issue Copy Permalink