Re: [vserver] Security issue: guest to host escape via TIOCSTI ioctl in vserver enter

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Wed 07 Nov 2012 - 20:54:51 GMT
Message-ID: <20121107205451.GC16263@MAIL.13thfloor.at>

On Wed, Nov 07, 2012 at 04:13:48PM +0000, halfdog wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1

> Security testing showed that when an admin enters a vserver guest from
> interactive shell, a malicious user inside the guest can use this to
> execute commands on the host. The current POC requires gdb to be
> installed, but it should be quite easy to write a small custom
> ptrace-program for that task. Risk rating should consider, that this
> vulnerability usually requires root privileges in guest to exploit,
> unless it is combined with similar "su" vulnerability, e.g. when
> performing "vserver xxx enter", "su postgres". See [1] for more
> information.

TIOCSTI only works if enabled for a guest (VXC_TIOCSTI)
so unless you have found a bug to circumvent this, I
think Linux-VServer is not affected.

thanks for the info though!

best,
Herbert

> hd

> [1] http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/

> - --
> http://www.halfdog.net/
> PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)

> iEYEARECAAYFAlCagIUACgkQxFmThv7tq+5B7QCgg1IGcHVzYPYQOxS+QpIeokUB
> fIAAnRiHCGgNpKuCMQ2GKMje2xG5uZ3q
> =FCX1
> -----END PGP SIGNATURE-----
Received on Wed Nov 7 20:54:59 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 07 Nov 2012 - 20:54:59 GMT by hypermail 2.1.8