Re: Security release for mod_wsgi (version 3.5)

[Tomas Hoger <thoger () redhat com>]

On Wed, 21 May 2014 11:46:32 +0200 Kurt Seifried wrote:

> So CVEs were assigned, this is now public, very well written an
> detailed write up is at:
>
> http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html

...

> Issue: Possibility of local privilege escalation when using daemon
> mode. (CVE-2014-0240)
>
> The issue is believed to affect Linux systems running kernel versions
> > = 2.6.0 and < 3.1.0.
>
> The issue affects all versions of mod_wsgi up to and including version
> 3.4.
>
> The source of the issue derives from mod_wsgi not correctly handling
> Linux specific error codes from setuid(), which differ to what would
> be expected to be returned by UNIX systems conforming to the Open
> Group UNIX specification for setuid().

Looking at the patch, mod_wsgi was previously expecting that setuid may
return error, it only failed to respond to the failure correctly.  It
only logged information about the failure, and continued to run with
unexpected privileges.

Few lines above the patched code, the same pattern is used for setgid
and setgroups / initgroups calls.  Is there a reason to not patch those
in the same way?  While there may be no such easy way to trigger failure
for those, their failure would also lead to user code running with
unexpected privileges.

-- 
Tomas Hoger / Red Hat Security Response Team