Hello community, here is the log from the commit of package sudo for openSUSE:Factory checked in at 2017-05-31 21:26:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sudo (Old) and /work/SRC/openSUSE:Factory/.sudo.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "sudo" Wed May 31 21:26:18 2017 rev:86 rq:499850 version:1.8.19p2 Changes: -------- --- /work/SRC/openSUSE:Factory/sudo/sudo.changes 2017-03-10 21:05:59.673182349 +0100 +++ /work/SRC/openSUSE:Factory/.sudo.new/sudo.changes 2017-05-31 21:26:19.337799096 +0200 @@ -1,0 +2,9 @@ +Tue May 30 19:11:42 UTC 2017 - sflees@suse.de + +- Fix a vulnerability in Sudo's get_process_ttyname() leading to + privlage elevation. + * sudo-1.8.19p2-CVE-2017-1000367.patch + * CVE-2017-1000367 + * bsc#1039361 + +------------------------------------------------------------------- New: ---- sudo-1.8.19p2-CVE-2017-1000367.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sudo.spec ++++++ --- /var/tmp/diff_new_pack.2QeaZM/_old 2017-05-31 21:26:20.221674395 +0200 +++ /var/tmp/diff_new_pack.2QeaZM/_new 2017-05-31 21:26:20.225673831 +0200 @@ -35,6 +35,7 @@ Patch1: sudo-sudoers.patch Patch2: sudo-1.8.19p2-decrement_env_len.patch Patch3: sudo-1.8.19p2-dont_overwrite_ret_val.patch +Patch4: sudo-1.8.19p2-CVE-2017-1000367.patch BuildRequires: audit-devel BuildRequires: cyrus-sasl-devel BuildRequires: groff @@ -78,6 +79,7 @@ %patch1 -p1 %patch2 -p1 %patch3 -p1 +%patch4 -p1 %build %ifarch s390 s390x %sparc ++++++ sudo-1.8.19p2-CVE-2017-1000367.patch ++++++ Index: sudo-1.8.19p2/src/ttyname.c =================================================================== --- sudo-1.8.19p2.orig/src/ttyname.c +++ sudo-1.8.19p2/src/ttyname.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2016 Todd C. Miller <Todd.Miller@courtesan.com> + * Copyright (c) 2012-2017 Todd C. Miller <Todd.Miller@courtesan.com> * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -145,20 +145,22 @@ sudo_ttyname_dev(dev_t tdev, char *name, } #elif defined(HAVE_STRUCT_PSINFO_PR_TTYDEV) || defined(HAVE_PSTAT_GETPROC) || defined(__linux__) /* - * Devices to search before doing a breadth-first scan. + * Device nodes and directories to search before searching all of /dev */ static char *search_devs[] = { "/dev/console", - "/dev/wscons", - "/dev/pts/", - "/dev/vt/", - "/dev/term/", - "/dev/zcons/", + "/dev/pts/", /* POSIX pty */ + "/dev/vt/", /* Solaris virtual console */ + "/dev/term/", /* Solaris serial ports */ + "/dev/zcons/", /* Solaris zone console */ + "/dev/pty/", /* HP-UX old-style pty */ NULL }; +/* + * Device nodes to ignore when searching all of /dev + */ static char *ignore_devs[] = { - "/dev/fd/", "/dev/stdin", "/dev/stdout", "/dev/stderr", @@ -166,16 +168,18 @@ static char *ignore_devs[] = { }; /* - * Do a breadth-first scan of dir looking for the specified device. + * Do a scan of a directory looking for the specified device. + * Does not descend into subdirectories. * Returns name on success and NULL on failure, setting errno. */ static char * -sudo_ttyname_scan(const char *dir, dev_t rdev, bool builtin, char *name, size_t namelen) +sudo_ttyname_scan(const char *dir, dev_t rdev, char *name, size_t namelen) { - size_t sdlen, num_subdirs = 0, max_subdirs = 0; - char pathbuf[PATH_MAX], **subdirs = NULL; + size_t sdlen; + char pathbuf[PATH_MAX]; char *ret = NULL; struct dirent *dp; + struct stat sb; unsigned int i; DIR *d = NULL; debug_decl(sudo_ttyname_scan, SUDO_DEBUG_UTIL) @@ -183,6 +187,18 @@ sudo_ttyname_scan(const char *dir, dev_t if (dir[0] == '\0' || (d = opendir(dir)) == NULL) goto done; + if (fstat(dirfd(d), &sb) == -1) { + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, + "unable to fstat %s", dir); + goto done; + } + if ((sb.st_mode & S_IWOTH) != 0) { + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, + "ignoring world-writable directory %s", dir); + errno = ENOENT; + goto done; + } + sudo_debug_printf(SUDO_DEBUG_INFO|SUDO_DEBUG_LINENO, "scanning for dev %u in %s", (unsigned int)rdev, dir); @@ -220,18 +236,6 @@ sudo_ttyname_scan(const char *dir, dev_t } if (ignore_devs[i] != NULL) continue; - if (!builtin) { - /* Skip entries in search_devs; we already checked them. */ - for (i = 0; search_devs[i] != NULL; i++) { - len = strlen(search_devs[i]); - if (search_devs[i][len - 1] == '/') - len--; - if (d_len == len && strncmp(pathbuf, search_devs[i], len) == 0) - break; - } - if (search_devs[i] != NULL) - continue; - } # if defined(HAVE_STRUCT_DIRENT_D_TYPE) && defined(DTTOIF) /* * Avoid excessive stat() calls by checking dp->d_type. @@ -244,39 +248,14 @@ sudo_ttyname_scan(const char *dir, dev_t if (stat(pathbuf, &sb) == -1) continue; break; - case DT_DIR: - /* Directory, no need to stat() it. */ - sb.st_mode = DTTOIF(dp->d_type); - sb.st_rdev = 0; /* quiet ccc-analyzer false positive */ - break; default: - /* Not a character device, link or directory, skip it. */ + /* Not a character device or link, skip it. */ continue; } # else if (stat(pathbuf, &sb) == -1) continue; # endif - if (S_ISDIR(sb.st_mode)) { - if (!builtin) { - /* Add to list of subdirs to search. */ - if (num_subdirs + 1 > max_subdirs) { - char **new_subdirs; - - new_subdirs = reallocarray(subdirs, max_subdirs + 64, - sizeof(char *)); - if (new_subdirs == NULL) - goto done; - subdirs = new_subdirs; - max_subdirs += 64; - } - subdirs[num_subdirs] = strdup(pathbuf); - if (subdirs[num_subdirs] == NULL) - goto done; - num_subdirs++; - } - continue; - } if (S_ISCHR(sb.st_mode) && sb.st_rdev == rdev) { sudo_debug_printf(SUDO_DEBUG_INFO|SUDO_DEBUG_LINENO, "resolved dev %u as %s", (unsigned int)rdev, pathbuf); @@ -292,16 +271,9 @@ sudo_ttyname_scan(const char *dir, dev_t } } - /* Search subdirs if we didn't find it in the root level. */ - for (i = 0; ret == NULL && i < num_subdirs; i++) - ret = sudo_ttyname_scan(subdirs[i], rdev, false, name, namelen); - done: if (d != NULL) closedir(d); - for (i = 0; i < num_subdirs; i++) - free(subdirs[i]); - free(subdirs); debug_return_str(ret); } @@ -320,7 +292,7 @@ sudo_ttyname_dev(dev_t rdev, char *name, debug_decl(sudo_ttyname_dev, SUDO_DEBUG_UTIL) /* - * First check search_devs for common tty devices. + * First check search_devs[] for common tty devices. */ for (sd = search_devs; (devname = *sd) != NULL; sd++) { len = strlen(devname); @@ -345,7 +317,7 @@ sudo_ttyname_dev(dev_t rdev, char *name, "comparing dev %u to %s: no", (unsigned int)rdev, buf); } else { /* Traverse directory */ - ret = sudo_ttyname_scan(devname, rdev, true, name, namelen); + ret = sudo_ttyname_scan(devname, rdev, name, namelen); if (ret != NULL || errno == ENOMEM) goto done; } @@ -363,9 +335,9 @@ sudo_ttyname_dev(dev_t rdev, char *name, } /* - * Not found? Do a breadth-first traversal of /dev/. + * Not found? Check all device nodes in /dev. */ - ret = sudo_ttyname_scan(_PATH_DEV, rdev, false, name, namelen); + ret = sudo_ttyname_scan(_PATH_DEV, rdev, name, namelen); done: debug_return_str(ret); @@ -489,28 +461,35 @@ get_process_ttyname(char *name, size_t n len = getline(&line, &linesize, fp); fclose(fp); if (len != -1) { - /* Field 7 is the tty dev (0 if no tty) */ - char *cp = line; - char *ep = line; - const char *errstr; - int field = 0; - while (*++ep != '\0') { - if (*ep == ' ') { - *ep = '\0'; - if (++field == 7) { - dev_t tdev = strtonum(cp, INT_MIN, INT_MAX, &errstr); - if (errstr) { - sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, - "%s: tty device %s: %s", path, cp, errstr); - } - if (tdev > 0) { - errno = serrno; - ret = sudo_ttyname_dev(tdev, name, namelen); - goto done; + /* + * Field 7 is the tty dev (0 if no tty). + * Since the process name at field 2 "(comm)" may include spaces, + * start at the last ')' found. + */ + char *cp = strrchr(line, ')'); + if (cp != NULL) { + char *ep = cp; + const char *errstr; + int field = 1; + + while (*++ep != '\0') { + if (*ep == ' ') { + *ep = '\0'; + if (++field == 7) { + dev_t tdev = strtonum(cp, INT_MIN, INT_MAX, &errstr); + if (errstr) { + sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO, + "%s: tty device %s: %s", path, cp, errstr); + } + if (tdev > 0) { + errno = serrno; + ret = sudo_ttyname_dev(tdev, name, namelen); + goto done; + } + break; } - break; + cp = ep + 1; } - cp = ep + 1; } } }