[Bug 1529486] Re: pt_chown arbitrary pts access via user namespace

[halfdog]

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2016-2856

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to glibc in Ubuntu.
https://bugs.launchpad.net/bugs/1529486

Title:
  pt_chown arbitrary pts access via user namespace

Status in glibc package in Ubuntu:
  Fix Released

Bug description:
  With Ubuntu Wily and earlier, /usr/lib/pt_chown was used to change
  ownership of slave pts devices in /dev/pts to the same uid holding the
  master file descriptor for the slave. This is done using the pt_chown
  SUID binary, which invokes the ptsname function on the master-fd, thus
  again performing a TIOCGPTN ioctl to get the slave pts number. Using
  the result from the ioctl, the pathname of the slave pts is
  constructed and chown invoked on it, see login/programs/pt_chown.c:

    pty = ptsname (PTY_FILENO);
    if (pty == NULL)
      ...
    /* Get the group ID of the special `tty' group.  */
    p = getgrnam (TTY_GROUP);
    gid = p ? p->gr_gid : getgid ();

    /* Set the owner to the real user ID, and the group to that special
       group ID.  */
    if (chown (pty, getuid (), gid) < 0)
      return FAIL_EACCES;

    /* Set the permission mode to readable and writable by the owner,
       and writable by the group.  */
    if ((st.st_mode & ACCESSPERMS) != (S_IRUSR|S_IWUSR|S_IWGRP)
        && chmod (pty, S_IRUSR|S_IWUSR|S_IWGRP) < 0)
      return FAIL_EACCES;

    return 0;

  The logic above is severely flawed, when there can be more than one
  master/slave pair having the same number and thus same name. But this
  condition can be easily created by creating an user namespace,
  mounting devpts with the newinstance option, create master and slave
  pts pairs until the number overlaps with a target pts outside the
  namespace on the host, where there is interest to gain ownership and
  then invoke pt_chown.

  See
  http://www.halfdog.net/Security/2015/PtChownArbitraryPtsAccessViaUserNamespace/
  for more information (User: InvitedOnly, Pass: QV4uLdKn, Sharing
  policy: see attachment).

  # lsb_release -rd
  Description:    Ubuntu 15.10
  Release:        15.10
  # apt-cache policy libc-bin
  libc-bin:
    Installed: 2.21-0ubuntu4
    Candidate: 2.21-0ubuntu4
    Version table:
   *** 2.21-0ubuntu4 0
          500 http://archive.ubuntu.com/ubuntu/ wily/main amd64 Packages
          100 /var/lib/dpkg/status

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1529486/+subscriptions