Linux chown() was racy relative to execve()

On non-ancient Linux machines, chown() clears the setuid and setgid bits.
However, until now, that was racy relative to execve(): While chown() took
the i_mutex while modifying owner, group and mode, execve() didn’t take that
lock. Because chown() also set the user and group before setting the mode,
this meant that when root chown()ed an attacker-owned setuid file to root,
the file briefly was setuid root (and executable as such).

This was fixed here by taking the i_mutex in the execve path:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b01fc86b9f425899f8a3a8fc1c47d73c2c20543

Two programs for which this could be relevant are procmail and vsftpd.

vsftpd has this comment in privops.c (relevant only if the chown_uploads
option, which defaults to NO, is activated in the server config, see
process_post_login_req() in postprivparent.c):

As far as I can tell, on a system where procmail is setuid root, this means
that an attacker who has gained access to the “mail” group, which has write
access to /var/mail, can use the chown race to escalate access to any non-root
uid. (procmail optimizes the chown away for root’s mailbox.)

Note that *stat() can still show inconsistent data about uid, gid and mode.
This wasn’t changed because the stat path is a lot hotter than execve and this
seems like a much bigger issue for execve() than for *stat().

Here’s a simple PoC. exec.c is the attacker, chown2.c is the (privileged)
victim. You’ll see the message “got root!” every time the attacker wins the
race.

Your console should get spammed with those messages rather quickly if you
don’t uncomment the usleep – if you do uncomment it, it might take a while to
succeed or not work at all. On my desktop machine, it still won the race for
6% of all attempts, but on another machine, it seems like it doesn’t work at
all with the usleep.

——————————————————————–
# just use asm to avoid overhead of dynamic loader

如果成功的话,会提示:“got root!”

原文链接:,转发请注明来源!

发表评论

要发表评论,您必须先登录