Vulnerability title: Privilege Escalation Via Symlink Attacks On POSIX Shared Memory With Insecure Permissions In AMD fglrx-driver

CVE:	CVE-2015-7723
Vendor:	AMD
Product:	fglrx-driver
Affected version:	14.4.2
Fixed version:	15.7
Reported by:	Tim Brown

Details:

It has been identified that the userland portion of the fglrx-driver utilised by Xorg allows privilege escalation via symlink attacks on POSIX shared memory with insecure permissions.

On systems with a Linux kernel where fs.protected_symlinks is not set to 1, or where this feature is not available, the following code (present in libaticaldd.so and fglrx_dri.so) calls shm_open() with insecure flags specified which allows the Linux kernel to follow an existent symlink under /dev/shm:

mov $0x1b6,%edx ; $edx (mode) = 0666
mov $0x42,%esi ; $esi (oflag) = O_CREAT | O_RDWR - missing O_EXCL
mov %r13,%rdi
callq 208b68 <shm_open@plt>

The same call to shm_open() requests that the permissions of newly created file are 0666 and as a result, an arbitrary file, owned by root, with permissions of 0666 can be created anywhere on the filesystem.

Furthermore, the code then proceeds to force the permissions on the resultant file to 0666 using fchmod(). This can be useful if the symlink target already exists:

mov $0x1b6,%esi ; $esi (mode) = 0666
mov %eax,%edi
callq 209058 <fchmod@plt>

Impact:

An attacker could create security sensitive files (such as libraries or configuration files), which when processed by a privileged program will lead to privilege escalation in instances where the program runs with privileges that the attacker does not have. For example, if the program is SetUID root, by creating a malicious library within a trusted location, an attacker would obtain root privileges upon exploiting this vulnerability.

Exploit:

The proof of concept exploit is available.

Remediation:

The vendor has released a patch.

Vendor status:

07/07/2014	Initial contact e-mails sent to support@, info@, admin@ and security@ amd.com and ati.com. They have an online form at http://emailcustomercare.amd.com/ but it crashes when trying to send submit
04/09/2014	Alternate security contact located
31/07/2015	Further details supplied. I have proposed that AMD check all use of shm_open()
07/10/2015	MITRE assigned CVE-2015-7723
19/10/2015	Published

Copyright:

Copyright © Portcullis Computer Security Limited 2015, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:

The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.