Re: Fixing su + runuser vulnerability CVE-2016-2779

["Ángel González" <ingenit@zoho.com>]

On 02/03/16 20:35, Stanislav Brabec wrote:
> Another possible fixes would be:
>
> - Request redirection of all I/O channels. (I. e. documentation fix
>    plus possible command line option to make it simpler.)
>
> - Or create custom pty container (like script does).
>
> - Or create a kernel level fix restricting TIOCSTI and let utilities as
>    they are.
>
> First two will have side effects, third seems to be a right way to me.

+1

IMHO a process without CAP_SYS_ADMIN (or similar) shouldn't be able to 
fake input¹ into a terminal owned² by a different user.


¹ yes, that's the goal of TIOCSTI)
² Not a complete solution, since you could have:
$ su root su $USER -s ./test_tiocsti

but if you are the owner of the terminal, it could do all kind of nasty 
things all the way down anyway.



> Additionally, https://bugzilla.redhat.com/show_bug.cgi?id=173008 says,
> that even it does not handle all possible attacks, because attacker can
> still read and write to the terminal:
>
> ==== steal.sh ====
> #!/bin/sh
> (
> sleep 3
> exec 0>&1
> echo "Hallo">/dev/stdout
> cat>/tmp/nobody-savefile
> )&
> ==================
>
> ~/util-linux # ./runuser -u nobody ./steal.sh
> ~/util-linux # Hallo

Nice use of background process with what is otherwise expected.
The is that the user is tricked into thinking that the child process 
[tree] has finished while it hasn't.

However, it doesn't seem work here:
> ./steal.sh: line 5: /dev/stdout: Permission denied
> cat: -: Input/output error