5 ms·

looking at the fixing commit[1]... does libpam not have unit tests..? [1]: https://github.com/linux-pam/linux-pam/commit/af0faf666c5008e54dfe43684f210e3581ff1b

looking at the fixing commit[1]... does libpam not have unit tests..? [1]: https://github.com/linux-pam/linux-pam/commit/af0faf666c5008e54dfe43684f210e3581ff1bca https://github.com/linux-pam/linux-pam/commit/af0faf666c5008...

saghm 6y ago
Does that actually fix it? The linked email listing says the issue is that logging in as a non-existent user with an empty password will work, and the fix that you linked seems to just make it harder to figure out if a user doesn't exist. That doesn't seem like it fixes anything; there's no need to determine beforehand if a user doesn't exist to use this exploit, since you could just try to use the exploit with an arbitrary username, and if it works, then obviously the user doesn't exist.
- kevinoid 6y ago
  I agree. I think the GP commit introduced the bug and the fixing commit was https://github.com/linux-pam/linux-pam/commit/30fdfb90d9864bcc254a62760aaa149d373fd4eb https://github.com/linux-pam/linux-pam/commit/30fdfb90d9864b...
  - EE84M3i 6y ago
    I just linked what was described as the "fixing commit" in the OP.
AceJohnny2 6y ago
I hate to be that guy, but _damn_ does PAM seem ripe for being rewritten in Rust. Maybe it's the PTSD speaking, but seeing vanilla C string operations in a security-critical library makes my hair stand on end. Searching around, the best I can find is one 0.1 crate that hasn't seen activity since 2017: https://crates.io/crates/librustpam https://crates.io/crates/librustpam
- Foxboron 6y ago
  Nothing about this CVE was related to the language though. It's a configuration issue along with nullok.
- yencabulator 6y ago
  Please, instead, let's have something that isn't a shared library loaded into everything. Something usable by contained/isolated/sandboxed software just by giving them a unix domain socket to talk to, with no need to share /etc/shadow.
- edgyquant 6y ago
  You should definitely write an MVP and come back with one. Or write a blog post explaining what parts would benefit and why it is a clear cut case for a rewrite and then post it here.
saagarjha 6y ago
I wonder if I should create a "pam_unix_non_existent:" account.
- icedchai 6y ago
  Can you actually do that? ":" is the separator in the password file.

saghm 6y ago

Does that actually fix it? The linked email listing says the issue is that logging in as a non-existent user with an empty password will work, and the fix that you linked seems to just make it harder to figure out if a user doesn't exist. That doesn't seem like it fixes anything; there's no need to determine beforehand if a user doesn't exist to use this exploit, since you could just try to use the exploit with an arbitrary username, and if it works, then obviously the user doesn't exist.

kevinoid 6y ago
I agree. I think the GP commit introduced the bug and the fixing commit was https://github.com/linux-pam/linux-pam/commit/30fdfb90d9864bcc254a62760aaa149d373fd4eb https://github.com/linux-pam/linux-pam/commit/30fdfb90d9864b...
- EE84M3i 6y ago
  I just linked what was described as the "fixing commit" in the OP.

AceJohnny2 6y ago

I hate to be that guy, but _damn_ does PAM seem ripe for being rewritten in Rust. Maybe it's the PTSD speaking, but seeing vanilla C string operations in a security-critical library makes my hair stand on end. Searching around, the best I can find is one 0.1 crate that hasn't seen activity since 2017: https://crates.io/crates/librustpam https://crates.io/crates/librustpam

Foxboron 6y ago
Nothing about this CVE was related to the language though. It's a configuration issue along with nullok.
yencabulator 6y ago
Please, instead, let's have something that isn't a shared library loaded into everything. Something usable by contained/isolated/sandboxed software just by giving them a unix domain socket to talk to, with no need to share /etc/shadow.
edgyquant 6y ago
You should definitely write an MVP and come back with one. Or write a blog post explaining what parts would benefit and why it is a clear cut case for a rewrite and then post it here.

saagarjha 6y ago

I wonder if I should create a "pam_unix_non_existent:" account.

icedchai 6y ago
Can you actually do that? ":" is the separator in the password file.