Re: CVE Request: powerdns does not clear supplementary groups

[Solar Designer <solar () openwall com>]

Kurt -

On Thu, May 24, 2012 at 12:40:10PM -0600, Kurt Seifried wrote:
> Supplemental groups enabled a user to be a member of more than one
> group at a time (us old timers remember the joys of "newgrp"). Why
> would anyone want this? You could for example create a group that has
> permissions to access logging, terminals (e.g. modems, remember those?
> =) and then add users to it as appropriate (and centralize
> account/permissions management somewhat and all that good stuff).

That's what initgroups(3) is for.  If a program that is supposed to drop
privs calls neither setgroups() nor initgroups(), or if it fails to
check the return value from these and refuse to proceed on failure, then
it is vulnerable.

> So what happens when a program starts running as say root, and root
> has supplemental groups (like "bin" or "daemon" and the program drops
> its primary user/group but fails to drop supplementary groups, is that
> a security issue,

Definitely.

> and is it worthy of a CVE identifier?

It should be.

> Having supplementary groups is intentional [...]

Having supplementary groups of the new (pseudo-)user, possibly yes.
Having supplementary groups of the old switched-from user, no.

Alexander