[vserver] Security issue: guest to host escape via TIOCSTI ioctl in vserver enter

From: halfdog <me_at_halfdog.net>
Date: Wed 07 Nov 2012 - 16:13:48 GMT
Message-ID: <509A88BC.4010506@halfdog.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Security testing showed that when an admin enters a vserver guest from
interactive shell, a malicious user inside the guest can use this to
execute commands on the host. The current POC requires gdb to be
installed, but it should be quite easy to write a small custom
ptrace-program for that task. Risk rating should consider, that this
vulnerability usually requires root privileges in guest to exploit,
unless it is combined with similar "su" vulnerability, e.g. when
performing "vserver xxx enter", "su postgres". See [1] for more
information.

hd

[1] http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/

- --
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAlCagIUACgkQxFmThv7tq+5B7QCgg1IGcHVzYPYQOxS+QpIeokUB
fIAAnRiHCGgNpKuCMQ2GKMje2xG5uZ3q
=FCX1
-----END PGP SIGNATURE-----
Received on Wed Nov 7 16:14:13 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 07 Nov 2012 - 16:14:13 GMT by hypermail 2.1.8