full-disclosure - COSEINC Linux Advisory #1: Linux Kernel Parent Process Death Signal Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0708141651370.2476@dione>
Date: Tue, 14 Aug 2007 17:17:14 +0200 (CEST)
From: Wojciech Purczynski <cliph@...c.pl>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	vulnwatch@...nwatch.org
Subject: COSEINC Linux Advisory #1: Linux Kernel Parent
 Process Death Signal Vulnerability

===[ ABSTRACT ]=========================================================

An unprivileged local user may send arbitrary signal to a child process
despite security restrictions.

===[ AFFECTED SOFTWARE ]================================================

Linux 2.6
Linux 2.4

For the exact kernel version please refer to an information provided by
your vendor.

===[ DESCRIPTION ]======================================================

Typically unprivileged user can not send signal to processes running
with different UID. Due to vulnerability found in the Linux kernel any
local user may bypass security restrictions and send arbitrary signal to
any child process executed by the user.

When a parent process dies or exits its child processes may receive a
signal.  Each child process may choose and set its own "parent process
death signal" using PR_SET_PDEATHSIG function of the prctl() system
call.

	PARENT		CHILD
	----------------------------------------------------------------
	fork()
			prctl(PR_SET_PDEATHSIG)
	exit()'ed or killed
			child receives the signal

The parent process death signal is not reset over execve() system call
and is inherited by spawned process:

	PARENT		CHILD
	----------------------------------------------------------------
	fork()
			prctl(PR_SET_PDEATHSIG)
			execve("./a.out")
	exit()'ed or killed
			child receives the signal

The signal gets delivered only if parent process has sufficient
privileges to send signals to child processes. Typically any child
process running with higher privilege than its parent will receive no
signal.

	PARENT		CHILD
	----------------------------------------------------------------
	fork()
			prctl(PR_SET_PDEATHSIG)
			execve("/bin/setuid-binary")
	exit()'ed or killed
			child receives NO signal this time

However, above restriction may be bypassed if parent process execute
setuid-root binary which dies afterwards.

	PARENT		CHILD
	----------------------------------------------------------------
	fork()
			prctl(PR_SET_PDEATHSIG)
			execve("/bin/setuid-binary")
	execve("/bin/setuid-binary")
	exit()'ed or killed
			privileged process receives the signal

===[ DISCLOSURE TIMELINE ]==============================================

27th July 2007		Vendor notification
14th August 2007	Public disclosure

===[ AUTHOR ]===========================================================

Wojciech Purczynski <cliph@...earch.coseinc.com>

Wojciech Purczynski is a Security Researcher at Vulnerability Research
Labs, COSEINC PTE Ltd. Wojciech Purczynski is also a member of iSEC
Security Research.

===[ LEGAL DISCLAIMER ]=================================================

Copyright (c) 2006,2007 Wojciech Purczynski
Copyright (c) 2007 COSEINC PTE Ltd.

All Rights Reserved.

PUBLISHING, DISTRIBUTING, PRINTING, COPYING, SCANNING, DUPLICATING IN
ANY FORM, MODIFYING WITHOUT PRIOR WRITTEN PERMISSION IS STRICTLY
PROHIBITED.

THE DOCUMENT IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. THE
CONTENT MAY CHANGE WITHOUT NOTICE. IN NO EVENT SHALL THE AUTHORS BE
LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES, INJURIES,
LOSSES OR UNLAWFUL OFFENCES.

USE AT YOUR OWN RISK.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/