oss-sec mailing list archives
Re: local privilege escalation due to capng_lock as used in seunshare
From: Solar Designer <solar () openwall com>
Date: Wed, 30 Apr 2014 02:35:52 +0400
On Tue, Apr 29, 2014 at 06:18:58PM -0400, Steve Grubb wrote:
On Wednesday, April 30, 2014 02:12:22 AM Solar Designer wrote:On Tue, Apr 29, 2014 at 05:49:04PM -0400, Steve Grubb wrote:On Tuesday, April 29, 2014 02:20:47 PM Andy Lutomirski wrote:if (setuid(getuid()) != 0) err(1, "setuid(getuid())");If you do not want the saved uid to be available, you need to use setresuid. That removes it. I would classify this as a bug in the test program.Not quite.If the program was amended to use setresuid(), does the bug still exist?
Yes, because it affects other similar correct programs that haven't yet been amended to work safely on your non-Unix system. ;-) Alternatively, you may declare that your system is deliberately incapable of running programs written for traditional Unix safely, and will stay that way. That will be a reason for people to prefer other Linux distros over Red Hat's, but at least it'd be fair. ;-( To paraphrase your question, since sendmail got a workaround for the old capabilities bug in the Linux kernel, does the bug in those old kernel versions still exist? The answer is also yes, it does, potentially affecting other programs running on those vulnerable kernels.(*) The bug needed to be fixed in the kernel, and it was (for later versions). (*) Of course, most people should not actually run those old kernels because of other vulnerabilities that have been found and fixed since, but that's a separate matter. I hope you don't mind the rhetoric. I mean it to be friendly. I hope it serves to deliver the message well. Alexander
Current thread:
- local privilege escalation due to capng_lock as used in seunshare Andy Lutomirski (Apr 29)
- Re: local privilege escalation due to capng_lock as used in seunshare Steve Grubb (Apr 29)
- Re: local privilege escalation due to capng_lock as used in seunshare Solar Designer (Apr 29)
- Re: local privilege escalation due to capng_lock as used in seunshare Steve Grubb (Apr 29)
- Re: local privilege escalation due to capng_lock as used in seunshare Solar Designer (Apr 29)
- Re: local privilege escalation due to capng_lock as used in seunshare Steve Grubb (Apr 30)
- Re: local privilege escalation due to capng_lock as used in seunshare Andy Lutomirski (Apr 30)
- Re: Re: local privilege escalation due to capng_lock as used in seunshare Steve Grubb (Apr 30)
- Re: local privilege escalation due to capng_lock as used in seunshare Solar Designer (Apr 30)
- Re: local privilege escalation due to capng_lock as used in seunshare Solar Designer (Apr 30)
- Re: local privilege escalation due to capng_lock as used in seunshare Andy Lutomirski (Apr 30)
- Re: local privilege escalation due to capng_lock as used in seunshare Daniel J Walsh (May 01)
- Re: local privilege escalation due to capng_lock as used in seunshare Solar Designer (Apr 29)
- Re: local privilege escalation due to capng_lock as used in seunshare Steve Grubb (Apr 29)
- Re: local privilege escalation due to capng_lock as used in seunshare Solar Designer (Apr 30)
- Re: local privilege escalation due to capng_lock as used in seunshare John Haxby (Apr 30)
- Re: local privilege escalation due to capng_lock as used in seunshare cve-assign (May 07)