On Wed, Nov 07, 2012 at 04:13:48PM +0000, halfdog wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> Security testing showed that when an admin enters a vserver guest from
> interactive shell, a malicious user inside the guest can use this to
> execute commands on the host. The current POC requires gdb to be
> installed, but it should be quite easy to write a small custom
> ptrace-program for that task. Risk rating should consider, that this
> vulnerability usually requires root privileges in guest to exploit,
> unless it is combined with similar "su" vulnerability, e.g. when
> performing "vserver xxx enter", "su postgres". See [1] for more
> information.
TIOCSTI only works if enabled for a guest (VXC_TIOCSTI)
so unless you have found a bug to circumvent this, I
think Linux-VServer is not affected.
thanks for the info though!
best,
Herbert
> hd
> [1] http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/
> - --
> http://www.halfdog.net/
> PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> iEYEARECAAYFAlCagIUACgkQxFmThv7tq+5B7QCgg1IGcHVzYPYQOxS+QpIeokUB
> fIAAnRiHCGgNpKuCMQ2GKMje2xG5uZ3q
> =FCX1
> -----END PGP SIGNATURE-----
Received on Wed Nov 7 20:54:59 2012