oss-sec mailing list archives
Re: Problems in automatic crash analysis frameworks
From: Florian Weimer <fweimer () redhat com>
Date: Fri, 17 Apr 2015 21:16:59 +0200
A quick update on the abrt situation. Most of these issues center around file ownership and contents under so-called problem directories (subdirectories of /var/tmp/abrt or /var/spool/abrt). Problem directories are owned by root and have mode 750 on Red Hat Enterprise Linux 6, which suggest that with this older abrt version, exploits are only possible if uploads are enabled in some way (see below). abrt writes coredumps to existing world-writable files owned by other users, disclosing coredump contents across user boundaries. This affects a default configuration, but requires an application to crash while its current directory is world-writable, so exploiting it seems difficult. We have assigned CVE-2015-3142. <https://bugzilla.redhat.com/show_bug.cgi?id=1212818> By default, abrt automatically runs post-crash actions on problem directories (event handling scripts). These scripts have symlink issues and other race conditions. This is more or less a repeat of the main abrt-hook-ccpp issue Tavis' reported, but at a higher level. It means that hardening the file system access in abrt-hook-ccpp is insufficient. We have assigned CVE-2015-1869: <https://bugzilla.redhat.com/show_bug.cgi?id=1212861> The default event handling scripts add a sosreport file (containing files which are not world-readable) and user-controlled excerpts from /var/log/messages to the user-readable problem directory. This is an information disclosure flaw, CVE-2015-1870: <https://bugzilla.redhat.com/show_bug.cgi?id=1212868> abrt has an upload functionality which allows, after non-default but documented/supported configuration, other systems to upload crash reports. This indirectly allows one to create a problem directory with symbolic links and unintended permissions, enabling further attacks. We treat this as a vulnerability, CVE-2015-3147: <https://bugzilla.redhat.com/show_bug.cgi?id=1212953> As explained in the parallel thread, abrt needs to disable user coredump files in fs.suid_dumpable=2 mode, like the kernel does, and we don't treat this as a vulnerability: <https://bugzilla.redhat.com/show_bug.cgi?id=1212873> It makes sense to have separate abrt-hook-ccpp implementation that does not write user coredump files. It would not have to write to arbitrary file system locations, so it can be restricted with SELinux. This enhancement is tracked as: <https://bugzilla.redhat.com/show_bug.cgi?id=1212885> There is a backlog of other issues for which I have not yet filed bugs. -- Florian Weimer / Red Hat Product Security
Current thread:
- Re: Re: Problems in automatic crash analysis frameworks, (continued)
- Re: Re: Problems in automatic crash analysis frameworks Florian Weimer (Apr 15)
- Re: Problems in automatic crash analysis frameworks Florian Weimer (Apr 15)
- Re: Problems in automatic crash analysis frameworks Tavis Ormandy (Apr 15)
- Re: Problems in automatic crash analysis frameworks Hanno Böck (Apr 15)
- Re: Problems in automatic crash analysis frameworks Tavis Ormandy (Apr 15)
- Re: Problems in automatic crash analysis frameworks cve-assign (Apr 15)
- Re: Re: Problems in automatic crash analysis frameworks Huzaifa Sidhpurwala (Apr 15)
- Re: Problems in automatic crash analysis frameworks cve-assign (Apr 15)
- Re: Re: Problems in automatic crash analysis frameworks Huzaifa Sidhpurwala (Apr 15)
- Re: Problems in automatic crash analysis frameworks cve-assign (Apr 16)
- Re: Re: Problems in automatic crash analysis frameworks Huzaifa Sidhpurwala (Apr 15)
- Re: Problems in automatic crash analysis frameworks Grandma Eubanks (Apr 17)
- Problems in automatic crash analysis frameworks Tavis Ormandy (Apr 17)
- Re: Problems in automatic crash analysis frameworks Tavis Ormandy (Apr 17)
- Re: Problems in automatic crash analysis frameworks Florian Weimer (Apr 23)
- Re: Problems in automatic crash analysis frameworks Florian Weimer (May 05)
- Re: Problems in automatic crash analysis frameworks Tavis Ormandy (May 05)
- Re: Problems in automatic crash analysis frameworks Florian Weimer (May 05)
- Re: Problems in automatic crash analysis frameworks Tavis Ormandy (May 05)
- Re: Re: Problems in automatic crash analysis frameworks Tavis Ormandy (Apr 15)