Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961)

[Eddie Chapman <eddie () ehuk net>]

On 10/10/18 13:53, Hanno Böck wrote:
> On Wed, 10 Oct 2018 10:10:58 +0100
> Eddie Chapman <eddie () ehuk net> wrote:
>
> > While the vulnerability in ghostscript itself is clear in this
> > thread, does anyone have any more info on the above aspect of this?
> > i.e is the above scenario (inadvertently running postscript, perhaps
> > contained in an image, through ghostscript by just browsing a
> > malicious site) limited to just nautilus in gnome environments? Do
> > other browsers/environments handle this better or do they do similar?
> > It seems that, strictly speaking, the "critical" nature of this
> > vulnerability hinges on the behaviour of the browser/desktop
> > environment. Otherwise the scope is limited to an individual manually
> > downloading a postscript file and opening it outside of the browser.
>
> evince installs a thumbnail entry to
> /usr/share/thumbnailers
>
> This is a generic location where applications can install files (I
> believe they follow the .desktop specification, which is an ini-based
> format). This is thus not nautilus-specific, but every filemanager that
> uses this format will be affected. A quick googling tells me e.g.
> pcmanfm is also affected. I'm not sure if dolphin uses them as well.
>
> Nautilus is trying to solve this by sandboxing the thumbnailers.
> However this depends on bubblewrap and is currently fail-open, i.e. if
> bubblewrap is not available it will not disable the thumbnailing, it
> will just not sandbox it. In practice this means it's often not
> sandboxed. I doubt this will change any time soon.
>
> Very similar problems show up with desktop search tools.
>
> I think this whole concept is questionable and should be reviewed. I
> think it's not desirable to have thumbnailers for all kinds of formats,
> instead a more reasonable approach would be to limit thumbnailing to a
> few widely used formats that have well-reviewed libraries (e.g. I don't
> think that libjpeg or libpng will have any vulnerabilities left that are
> even remotely as severe as the things tavis found in ghostscript).

Ah OK, I got confused (having not used gnome or nautilus for a long 
time) of what exactly Nautilus' role is here. Because Tavis mentioned 
web browsing and nautilus together in my mind I was thinking nautilus 
was the web browser here forgot it's a file manager :-)

But I'm still unclear how "just browsing a website is enough to trigger 
the vulnerability in some common configurations." Are we talking about 
the user looking in their web browser cache directory on the filesystem 
using Nautilus, and hence running malicious code embedded in a cached 
file via the evince thumbnailer on opening that directory? Or maybe 
Nautilus/Gnome automatically runs the thumbnailer on every new file 
created in the user's home directory (via inotify?), including whatever 
the browser saves in the background (hopefully not)? Or is it just a 
case of the user opening a downloaded file with evince and becoming a 
victim that way? Though that is not exactly automatic, most browsers 
show a prompt asking what to do with a downloaded file.

So, still slightly confused, how one can become a victim here just 
browsing a website. It's probably obvious to everyone but I'm not 
getting it having always run a quite minimal desktop for years 
(currently a mixture of Awesome window manager + some Mate elements, 
caja file manager) .... Or maybe no-one wants to spell it out so as not 
to give the bad guys any free tips. So feel free to ignore me if it's 
either of those :-)