4 ms·

CVE-2017-1000367 in Sudo's get_process_ttyname() for Linux

44 points by miduil 9y ago

ryanlol 9y ago
This bug is not a very big deal, it can only be exploited by users that already have sudo access. The publicity it's receiving is mostly undeserved.
- wyldfire 9y ago
  Sudo can be configured to grant very limited access to specific users, to run specific programs, run as privileged-but-not-superuser, etc. [1] [1] https://www.sudo.ws/man/1.8.15/sudoers.man.html https://www.sudo.ws/man/1.8.15/sudoers.man.html
  - ryanlol 9y ago
    I'm aware, but the in the end that's a relatively uncommon configuration, and would still usually require the users password increasing difficulty of exploitation even further. Not only that, but in my experience people tend to screw up these setups most of the time allowing easy root shells without sudo vulns.
    - wyldfire 9y ago
      > usually require the users password increasing difficulty of exploitation even further. Unless the user themselves is the perpetrator. They know their own password and the superuser believes that the system restrictions will grant them only the limited access that they specified.
      - ryanlol 9y ago
        I think at this point we've established just how few people this bug impacts.
        wyldfire 9y ago
        I will concede that it's not time to panic, but it's a security bug and one that we know about. Let's continue to keep the bar high for successful exploits.
    - SteveNuts 9y ago
      Are you saying that granting limited sudo access to only specific programs is rare? That's the standard way to do it in every large enterprise, you just don't grant sudo all. Only in the cloud space is the "sudo all nopasswd" a thing (ubuntu user on AWS).
      - rkeene2 9y ago
        Unless you are very particular about the commands added, most configurations end up being equivariant to ALL. Some examples I've seen: ip, less, vi, tar, cp, mv, mount, chmod, chown, zip, mysql, dd, ... Any of those and many many more allow for trivial jumping to any command as the target user and you're not improving your security posture compared to ALL, though you make some work harder and some mistakes less likely.
  - deleted 9y ago
    [deleted]
  - quotemstr 9y ago
    Right. Some people use sudo as a way to avoid having to provide setuid programs.
- k_sze 9y ago
  I don't know Linux internals enough to be sure, but maybe this bug is a big deal because it would circumvent logging (even remote rsyslog daemons)? I.E. a sudoer could do nasty things on the system while leaving little to no trace?
  - ryanlol 9y ago
    This bug isn't a big deal because it only affects a relatively rare configuration that is very often otherwise vulnerable anyway. Linux privesc bugs generally aren't exactly a super big deal.
mitchtbaum 9y ago
For those interested in a Rust lang rewrite (only a week old even), see https://github.com/shawnanastasio/rudo https://github.com/shawnanastasio/rudo and some reviews at https://www.reddit.com/r/rust/comments/6d5smn/rudo_a_toy_sudo_clone_written_in_rust_xpost/ https://www.reddit.com/r/rust/comments/6d5smn/rudo_a_toy_sud...
- jzwinck 9y ago
  Not really relevant. The main bug being discussed is a text parsing bug related to syntax, not memory access errors or the like. Rust seems cool and all but it isn't immune to logical errors.
IshKebab 9y ago
> Unfortunately, these fields are space-separated and field 2 (comm, the filename of the command) can contain spaces Well that's embarrassing. Text-based formats don't look so great now do they?

44 points by miduil 9y ago

This bug is not a very big deal, it can only be exploited by users that already have sudo access. The publicity it's receiving is mostly undeserved.

wyldfire 9y ago
Sudo can be configured to grant very limited access to specific users, to run specific programs, run as privileged-but-not-superuser, etc. [1] [1] https://www.sudo.ws/man/1.8.15/sudoers.man.html https://www.sudo.ws/man/1.8.15/sudoers.man.html
- ryanlol 9y ago
  I'm aware, but the in the end that's a relatively uncommon configuration, and would still usually require the users password increasing difficulty of exploitation even further. Not only that, but in my experience people tend to screw up these setups most of the time allowing easy root shells without sudo vulns.
  - wyldfire 9y ago
    > usually require the users password increasing difficulty of exploitation even further. Unless the user themselves is the perpetrator. They know their own password and the superuser believes that the system restrictions will grant them only the limited access that they specified.
    - ryanlol 9y ago
      I think at this point we've established just how few people this bug impacts.
      - wyldfire 9y ago
        I will concede that it's not time to panic, but it's a security bug and one that we know about. Let's continue to keep the bar high for successful exploits.
  - SteveNuts 9y ago
    Are you saying that granting limited sudo access to only specific programs is rare? That's the standard way to do it in every large enterprise, you just don't grant sudo all. Only in the cloud space is the "sudo all nopasswd" a thing (ubuntu user on AWS).
    - rkeene2 9y ago
      Unless you are very particular about the commands added, most configurations end up being equivariant to ALL. Some examples I've seen: ip, less, vi, tar, cp, mv, mount, chmod, chown, zip, mysql, dd, ... Any of those and many many more allow for trivial jumping to any command as the target user and you're not improving your security posture compared to ALL, though you make some work harder and some mistakes less likely.
- deleted 9y ago
  [deleted]
- quotemstr 9y ago
  Right. Some people use sudo as a way to avoid having to provide setuid programs.
k_sze 9y ago
I don't know Linux internals enough to be sure, but maybe this bug is a big deal because it would circumvent logging (even remote rsyslog daemons)? I.E. a sudoer could do nasty things on the system while leaving little to no trace?
- ryanlol 9y ago
  This bug isn't a big deal because it only affects a relatively rare configuration that is very often otherwise vulnerable anyway. Linux privesc bugs generally aren't exactly a super big deal.

mitchtbaum 9y ago

For those interested in a Rust lang rewrite (only a week old even), see https://github.com/shawnanastasio/rudo https://github.com/shawnanastasio/rudo and some reviews at https://www.reddit.com/r/rust/comments/6d5smn/rudo_a_toy_sudo_clone_written_in_rust_xpost/ https://www.reddit.com/r/rust/comments/6d5smn/rudo_a_toy_sud...

jzwinck 9y ago
Not really relevant. The main bug being discussed is a text parsing bug related to syntax, not memory access errors or the like. Rust seems cool and all but it isn't immune to logical errors.

IshKebab 9y ago

> Unfortunately, these fields are space-separated and field 2 (comm, the filename of the command) can contain spaces Well that's embarrassing. Text-based formats don't look so great now do they?