cve id request: insecure xauth cookie handling in fglrx (ati catalyst) driver

[Michael Gilbert <michael.s.gilbert () gmail com>]

Hi,

This may be an odd request.  The proprietary fglrx driver has an
info disclosure flaw in one of it's shell scripts [0].  It passes the
xauth secret cookie in an insecure manner (such that it's exposed to
prying eyes in the output of ps for example).

The oddness in this request is that the driver is proprietary; but
then again it is also included in most linux distributions in one form
or another, so I think oss-sec is an appropriate forum.  There is also
a specific additional right granted in the script's header: "Distro
maintainers may modify this reference script as necessary to conform
to their distribution policies."

This is debian bug #625868 [1], and I've commited an untested fix
(I don't use authatieventsd myself) to our svn repo [2].

Note that there is discussion in the bug report claiming the
debian-specific patch is to blame, but that conclusion is incorrect.
The same flaw is also present in the upstream ati code as well.
The debian code is only different in that it was made to handle a
slightly different use case, but the underlying flaw is indeed
present in both, so other distros are very likely affected as well.

Note also that xauth's design makes this insecure usage seem like
an obvious solution for the cookie handling problem, so there are
probably many other flawed implementations like this, which could
be found by grepping for xauth and auditing those cases handling
the secret cookie.  This may be something worth calling out as a
CWE.

Credit goes to Vincent Zweije who submitted the debian bug report.

Best wishes,
Mike

[0] common/etc/ati/authatieventsd.sh
[1] http://bugs.debian.org/625868
[2] svn://svn.debian.org/svn/pkg-fglrx/fglrx-driver/trunk