Linux 2.4.x execve() file read race vulnerability

2003-06-27T00:00:00
ID SECURITYVULNS:DOC:4753
Type securityvulns
Reporter Securityvulns
Modified 2003-06-27T00:00:00

Description

Hi people,

again it is time to discover a funny bug inside the Linux execve() system call.

Details:

While looking at the execve() code I've found the following piece of code (from fs/binfmt_elf.c):

static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs) { struct file interpreter = NULL; / to shut gcc up */

[...]

retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *)

elf_phdata, size); if (retval < 0) goto out_free_ph;

retval = get_unused_fd&#40;&#41;;
if &#40;retval &lt; 0&#41;
    goto out_free_ph;
get_file&#40;bprm-&gt;file&#41;;
fd_install&#40;elf_exec_fileno = retval, bprm-&gt;file&#41;;

So, during the execution of new binary, the opened file descriptor to the executable is put into the file table of the current (the caller of execve()) process. This can be exploited creating a file sharing parent/child pair by means of the clone() syscall and reading the file descriptor from one of them.

Further, the check for shared files structure (in compute_creds() from exec.c) is made to late, so even the parent can successfully exit after playing games on that file descriptor and the child (if setuid) is executed under full privileges. I wrote a simple setuid binary dump utility so far, but further implications (due to the complexity of the execve() syscall) may be possible...

Lets illustrate the vulnerability:

paul@buggy:~> ls -l /bin/ping -rws--x--x 1 root root 29680 Oct 25 2001 /bin/ping

so the setuid ping binary can be only executed by anyone, but not read.

Now we start the suid dumper (while playing with the disk on another console like cat /usr/bin/* >/dev/null) :

paul@buggy:~> while true ; do ./suiddmp /bin/ping -c 1 127.0.0.1 ; if test $? -eq 1 ; then exit 1 ; fi; done 2>/dev/null | grep -A5 suc

and after few seconds:

Parent success stating: uid 0 gid 0 mode 104711 inode 9788 size 29680 PING 127.0.0.1 (127.0.0.1) from 127.0.0.1 : 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=94 usec

--- 127.0.0.1 ping statistics ---

paul@buggy:~> ls -l total 7132 -rwxr-xr-x 1 paul users 29680 Jun 26 19:17 suid.dump [...]

paul@buggy:~> ./suid.dump Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline] [-p pattern] [-s packetsize] [-t ttl] [-I interface or address] [-M mtu discovery hint] [-S sndbuf] [ -T timestamp option ] [ -Q tos ] [hop1 ...] destination

Obviously the setuid binary has been duplicated :-) (but with no setuid flag of course).

Source also available at:

http://www.starzetz.com/paul/suiddmp.c

/ih