diff options
| author | Carlos O'Donell <carlos@redhat.com> | 2013-07-19 02:42:03 -0400 |
|---|---|---|
| committer | Carlos O'Donell <carlos@redhat.com> | 2013-07-21 15:39:55 -0400 |
| commit | e4608715e6e1dd2adc91982fd151d5ba4f761d69 (patch) | |
| tree | 04bc13d3736e14045f0f9fc37e0303a067f943cf /sysdeps/unix/sysv/linux/grantpt.c | |
| parent | da2d62df77de66e5de5755228759f8bc18481871 (diff) | |
CVE-2013-2207, BZ #15755: Disable pt_chown.
The helper binary pt_chown tricked into granting access to another
user's pseudo-terminal.
Pre-conditions for the attack:
* Attacker with local user account
* Kernel with FUSE support
* "user_allow_other" in /etc/fuse.conf
* Victim with allocated slave in /dev/pts
Using the setuid installed pt_chown and a weak check on whether a file
descriptor is a tty, an attacker could fake a pty check using FUSE and
trick pt_chown to grant ownership of a pty descriptor that the current
user does not own. It cannot access /dev/pts/ptmx however.
In most modern distributions pt_chown is not needed because devpts
is enabled by default. The fix for this CVE is to disable building
and using pt_chown by default. We still provide a configure option
to enable hte use of pt_chown but distributions do so at their own
risk.
Diffstat (limited to 'sysdeps/unix/sysv/linux/grantpt.c')
| -rw-r--r-- | sysdeps/unix/sysv/linux/grantpt.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sysdeps/unix/sysv/linux/grantpt.c b/sysdeps/unix/sysv/linux/grantpt.c index 0a3cd472fa..8cebde36ed 100644 --- a/sysdeps/unix/sysv/linux/grantpt.c +++ b/sysdeps/unix/sysv/linux/grantpt.c @@ -11,7 +11,7 @@ #include "pty-private.h" - +#if HAVE_PT_CHOWN /* Close all file descriptors except the one specified. */ static void close_all_fds (void) @@ -38,6 +38,7 @@ close_all_fds (void) __dup2 (STDOUT_FILENO, STDERR_FILENO); } } -#define CLOSE_ALL_FDS() close_all_fds() +# define CLOSE_ALL_FDS() close_all_fds() +#endif #include <sysdeps/unix/grantpt.c> |