bugtraq - R: Linux kernel source archive vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <D432C2F98B6D1B4BAE47F2770FEFD6B612B8B7@to1mbxs02.replynet.prv>
Date: Fri, 8 Sep 2006 10:43:12 +0200
From: "Perego Paolo Franco" <p.perego@...ly.it>
To: "Hadmut Danisch" <hadmut@...isch.de>, <bugtraq@...urityfocus.com>
Subject: R: Linux kernel source archive vulnerable

Hi Hadmut, by the way cross post is bad so I'll reply only in bugtraq. The ones you 
report are not, IMHO, vulnerability in Linux Kernel source code archive.
May be you want to administer your severs ina secure fashoned way involving a 
proper ownership access to /user/src and /lib/modules path ensuring that regular 
user belonging to special group can write into it.
If "compile it's usually done as root" is not a kernel vulnerability but a non secure 
aware sysadmin behaviour. 
Consider "--no-same-owner" or "--owner" tar flags in order to customize extracted
file ownership.

Anyway just few considerations:
1) a server exposed to Interne, is NOT supposed to have compiler installed in it. 
You may use a compile machine to build custom kernel and installing to your production 
environment or you may want to use your ditribution kernel package.
So you don't need to have /usr/src/linux at all.
2) a good sysadmin is aware that /usr/src is NOT supposed to be world writable

Anyway... I don't think this is a "severe vulnerability in the Linux kernel source code
archives". IMHO, of course

My 0,02EUR

sp0nge

________________________________

Da: Hadmut Danisch [mailto:hadmut@...isch.de]
Inviato: gio 07/09/2006 20.23
A: full-disclosure@...ts.grok.org.uk; bugtraq@...urityfocus.com
Oggetto: Linux kernel source archive vulnerable

Hi,

there's a severe vulnerability in the Linux kernel source code archives:

The Linux kernel is distributed as tar archives in the form of
linux-2.6.17.11.tar.bz2 from kernel.org. It is usually unpacked,
configured and compiled under /usr/src. Since installing a new kernel
requires root privileges, this is usually done as root.

When unpacking such an archive, tar also sets the uid, gid, and file
permissions given in the tar archive. Unfortunately, plenty of files and
directories in that archive are world writable. E.g. in the 2.6.17.11
archive, there are 1201 world writable directories and 19554 world
writable files.

This opens the door for at least three kinds of attacks:

1. Whoever manages to exploit any server (e.g. PHP on a webserver) has
   world writable directories at a well defined place, perfect to hide
   any malware, bot, rootkit,...

2. Any user or intruder can modify the kernel source and thus compromise
   the kernel to be compiled.

3. any user or intruder could modify the build or installation
   system/Makefiles in order to have any kind of malware executed by
   root the next time a kernel is built or installed, or any other
   kernel module making use of the kernel tree.

Solution: Ensure that the file ownership and permissions are set
properly before distributing the tar archive.

regards
Hadmut

--
The information transmitted is intended for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.