Vulnerability title: Privilege Escalation Via Symlink Attacks On POSIX Shared Memory With Insecure Permissions In AMD fglrx-driver
| CVE: | CVE-2015-7723 |
| Vendor: | AMD |
| Product: | fglrx-driver |
| Affected version: | 14.4.2 |
| Fixed version: | 15.7 |
| Reported by: | Tim Brown |
Details:
It has been identified that the userland portion of the fglrx-driver utilised by Xorg allows privilege escalation via symlink attacks on POSIX shared memory with insecure permissions.
On systems with a Linux kernel where fs.protected_symlinks is not set to 1, or where this feature is not available, the following code (present in libaticaldd.so and fglrx_dri.so) calls shm_open() with insecure flags specified which allows the Linux kernel to follow an existent symlink under /dev/shm:
mov $0x1b6,%edx ; $edx (mode) = 0666 mov $0x42,%esi ; $esi (oflag) = O_CREAT | O_RDWR - missing O_EXCL mov %r13,%rdi callq 208b68 <shm_open@plt>
The same call to shm_open() requests that the permissions of newly created file are 0666 and as a result, an arbitrary file, owned by root, with permissions of 0666 can be created anywhere on the filesystem.
Furthermore, the code then proceeds to force the permissions on the resultant file to 0666 using fchmod(). This can be useful if the symlink target already exists:
mov $0x1b6,%esi ; $esi (mode) = 0666 mov %eax,%edi callq 209058 <fchmod@plt>
Impact:
An attacker could create security sensitive files (such as libraries or configuration files), which when processed by a privileged program will lead to privilege escalation in instances where the program runs with privileges that the attacker does not have. For example, if the program is SetUID root, by creating a malicious library within a trusted location, an attacker would obtain root privileges upon exploiting this vulnerability.
Exploit:
The proof of concept exploit is available.
Remediation:
The vendor has released a patch.
Vendor status:
| 07/07/2014 | Initial contact e-mails sent to support@, info@, admin@ and security@ amd.com and ati.com. They have an online form at http://emailcustomercare.amd.com/ but it crashes when trying to send submit |
| 04/09/2014 | Alternate security contact located |
| 31/07/2015 | Further details supplied. I have proposed that AMD check all use of shm_open() |
| 07/10/2015 | MITRE assigned CVE-2015-7723 |
| 19/10/2015 | Published |
Copyright:
Copyright © Portcullis Computer Security Limited 2015, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.
Disclaimer:
The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.