linux-kernel - Re: Do people exaggerate in security advisories?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 04 Jan 2008 15:28:08 -0500
From:	Valdis.Kletnieks@...edu
To:	Manuel Reimer <Manuel.Spam@...fuerspam.de>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: Do people exaggerate in security advisories?

On Fri, 04 Jan 2008 13:21:32 +0100, Manuel Reimer said:

> Is it really possible to get root privileges with this bug or are there 
> people who just write "may be used to escalate privileges" near any bug 
> which has something to do with "setuid" or "setgid"?

It looks like it really *is* possible to do some damage, if you can make
several things happen:

1) Cause set[ug]id() to fail, possibly using a crafted 'capabilities' list.
2) Get it to invoke a helper that's now running with different permissions than
it was designed to, and feed said helper some carefully crafted malicious or
bogus data.

Given that it is semantically almost identical to the Sendmail-capabilities
bug from a few years ago, which was *certainly* abusable to get root, it would
be foolish to think anything *except* "this sucker should be assumed to be
a root exploit until *proven* otherwise".  Anybody who thinks "I don't see
how to exploit it, so it can't be done" is in for a rude surprise....

Content of type "application/pgp-signature" skipped