Re: [vserver] Security issue: guest to host escape via TIOCSTI ioctl in vserver enter

From: halfdog <me_at_halfdog.net>
Date: Wed 07 Nov 2012 - 21:53:02 GMT
Message-ID: <509AD83E.1000100@halfdog.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Herbert Poetzl wrote:
> On Wed, Nov 07, 2012 at 04:13:48PM +0000, halfdog wrote: Security
> testing showed that when an admin enters a vserver guest from
> interactive shell, a malicious user inside the guest can use this
> to execute commands on the host. ...
>
>> TIOCSTI only works if enabled for a guest (VXC_TIOCSTI) so
>> unless you have found a bug to circumvent this, I think
>> Linux-VServer is not affected.

That's strange, perhaps I made some mistake during testing with the
packages from repo.psand.net. Is VXC_TIOCSTI enabled by default, how
to check that it is really disabled. And did you try to run the
gdb-test? Were there any errors attaching to the process or during exec?

I'll try to run test-set again from completely fresh setup as soon as
possible. (or do you have a completely sane test environment available?)

> [1]
> http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/

- --
http://www.halfdog.net/
PGP:
>
156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAlCa19wACgkQxFmThv7tq+7vQQCfXFqKlbudPXCANMPoE0TUuETK
gC0Aniqjm0QRUIZdhyTBIQaxdbKw7KCO
=8bfi
-----END PGP SIGNATURE-----
Received on Wed Nov 7 21:53:36 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 07 Nov 2012 - 21:53:36 GMT by hypermail 2.1.8