RE: [EXTERNAL] Re: [oss-security] ncurses fixes upstream

["Jonathan Bar Or (JBO)" <jobaror () microsoft com>]

Yes, now that the cat is out of the bag there's no point - you can find some POCs here (not every find is covered by a 
POC, FYI):
https://drive.google.com/drive/u/0/folders/1XZiHbH7W7is8cwTu7DKrpwBTYuYfRZqE

Note not all of them work on Linux - some are macOS focused too.

As for Taviso's remark - obviously using "iprog", "rf" or "if" capabilities can be used maliciously if an attacker is 
able to affect root's terminfo files (directly or with env-vars), but those capabilities are only used by a bunch of 
programs (e.g. reset, tput and others). Normally putting an "iprog" and calling another ncurses using binary (e.g. top) 
won't run that program.
To be honest, we focused on EoP scenarios, and specifically macOS. macOS is the most sensitive here, since "top" is a 
SUID binary and doesn't sanitize TERMINFO (or HOME, which can be used too). The bus we found are several memory 
corruption issues that happen during terminfo db parsing, as well as ncurses functions (e.g. tparm).

JBO

-----Original Message-----
From: Carlos López <clopez () suse de> 
Sent: Wednesday, April 19, 2023 8:11 AM
To: Jonathan Bar Or (JBO) <jobaror () microsoft com>
Cc: oss-security () lists openwall com
Subject: [EXTERNAL] Re: [oss-security] ncurses fixes upstream

[You don't often get email from clopez () suse de. Learn why this is important at 
https://aka.ms/LearnAboutSenderIdentification ]

Hi,

On 12/4/23 22:40, Jonathan Bar Or (JBO) wrote:
> Hello oss-security,
>
> Our team has worked with the maintainer of the ncurses library (used by several software packages in Linux) to fix 
> several memory corruption vulnerabilities.
> They are now fixed at commit 20230408 - see details here 
> (https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Finv
> isible-island.net%2Fncurses%2FNEWS.html%23index-t20230408&data=05%7C01
> %7Cjobaror%40microsoft.com%7C0102d7187e894898280408db40e85af7%7C72f988
> bf86f141af91ab2d7cd011db47%7C1%7C0%7C638175138959984222%7CUnknown%7CTW
> FpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6
> Mn0%3D%7C3000%7C%7C%7C&sdata=uRH%2FEXS1rhbBT9vsPN92PjfwjFw9UNLehU9ksP6
> TX8s%3D&reserved=0) A CVE was assigned (CVE-2023-29491) - it's still 
> under a "reserved" status.

Are there any plans to disclose any proofs of concept to test these issues? From the distro side these are not only 
useful to check which ncurses snapshots we need to fix, but also for our QA teams to test the update and detect 
regressions.

For example, we are not sure if the build option `--disable-root-environ` does anything to mitigate the issues.

> How can we ensure those fixes get deployed upstream, in major Linux distributions?
> We've reached out to Arch, RedHat, Canonical and other popular distros independently.
>
> Thanks!
>                               JBO

For what is worth, we have not been contacted, as far as I can tell.

Best,
Carlos

--
Carlos López
Security Engineer
SUSE Software Solutions