SystemTap模块加载本地竞争条件漏洞

2009-04-02T00:00:00
ID SSV:4986
Type seebug
Reporter Root
Modified 2009-04-02T00:00:00

Description

BUGTRAQ ID: 34260 CVE(CAN) ID: CVE-2009-0784

SystemTap是一款Linux内核诊断工具,允许从运行中的Linux内核快速和安全地获取信息。

systemtap在检查和加载某些内核模块时存在竞争条件。漏洞起因是checkpath()检查了路径(module_realpath变量),但之后没有使用该路径打开文件。因此,用户可以要求stap加载当前目录中符号链接到有效内核对象的内核模块,然后迅速用恶意内核对象替换符号链接所指向的对象,导致执行本应受限制的目录之外的内核对象。

成功利用这个漏洞可能允许stapusr组中的用户将权限提升到stapdev组成员的权限(root),但仅在当前运行内核的systemtap/模块目录中放置了另一个SystemTap内核模块的情况下才可以利用这个漏洞。

SystemTap SystemTap 0.0.20090314 SystemTap SystemTap 0.0.20080705 厂商补丁:

Debian

Debian已经为此发布了一个安全公告(DSA-1755-1)以及相应补丁: DSA-1755-1:New systemtap packages fix local privilege escalation 链接:<a href=http://www.debian.org/security/2009/dsa-1755 target=_blank rel=external nofollow>http://www.debian.org/security/2009/dsa-1755</a>

补丁下载:

Source archives:

<a href=http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705.orig.tar.gz target=_blank rel=external nofollow>http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705.orig.tar.gz</a> Size/MD5 checksum: 880805 8f14c7b79561392e7ec91187ed09f3be <a href=http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1.diff.gz target=_blank rel=external nofollow>http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1.diff.gz</a> Size/MD5 checksum: 12603 b08a9943746e474ed2aa6ed4bc9fc438 <a href=http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1.dsc target=_blank rel=external nofollow>http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1.dsc</a> Size/MD5 checksum: 1420 bfbaeb5d86bfd6876a04e562dc8c69ec

amd64 architecture (AMD x86_64 (AMD64))

<a href=http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_amd64.deb target=_blank rel=external nofollow>http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_amd64.deb</a> Size/MD5 checksum: 1250966 d8368769f30ecaa915839a1fc937899d

arm architecture (ARM)

<a href=http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_arm.deb target=_blank rel=external nofollow>http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_arm.deb</a> Size/MD5 checksum: 1309852 7e006ca8bfa2bd36484bd25dda6dcb4c

i386 architecture (Intel ia32)

<a href=http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_i386.deb target=_blank rel=external nofollow>http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_i386.deb</a> Size/MD5 checksum: 1249882 ed02a4eb92c671f18702b69df5ade6d5

ia64 architecture (Intel ia64)

<a href=http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_ia64.deb target=_blank rel=external nofollow>http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_ia64.deb</a> Size/MD5 checksum: 1441448 7da28afa66b41d81322cf5614cb9af93

powerpc architecture (PowerPC)

<a href=http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_powerpc.deb target=_blank rel=external nofollow>http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_powerpc.deb</a> Size/MD5 checksum: 1269934 3016e60eb5dbab1b617bf088d807489c

s390 architecture (IBM S/390)

<a href=http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_s390.deb target=_blank rel=external nofollow>http://security.debian.org/pool/updates/main/s/systemtap/systemtap_0.0.20080705-1+lenny1_s390.deb</a> Size/MD5 checksum: 1227546 9edb1baaa6a126a405674be0a9dcf12c

补丁安装方法:

  1. 手工安装补丁包:

首先,使用下面的命令来下载补丁软件: # wget url (url是补丁下载链接地址)

然后,使用下面的命令来安装补丁:
# dpkg -i file.deb (file是相应的补丁名)

  1. 使用apt-get自动安装补丁包:

首先,使用下面的命令更新内部数据库: # apt-get update

然后,使用下面的命令安装更新软件包: # apt-get upgrade

RedHat

RedHat已经为此发布了一个安全公告(RHSA-2009:0373-01)以及相应补丁: RHSA-2009:0373-01:Moderate: systemtap security update 链接:<a href=https://www.redhat.com/support/errata/RHSA-2009-0373.html target=_blank rel=external nofollow>https://www.redhat.com/support/errata/RHSA-2009-0373.html</a>

SystemTap

目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:

<a href=http://sources.redhat.com/git/?p=systemtap.git;a=commit;h=b41a544e20a42413daa0323d2f149e9e34586ccf target=_blank rel=external nofollow>http://sources.redhat.com/git/?p=systemtap.git;a=commit;h=b41a544e20a42413daa0323d2f149e9e34586ccf</a>