mount/umount realpath() buffer overflow

[davem () iss net (David J. Meltzer)]

The problem "bloodmask" "discovered" (this bug has been exploited and
reported as a possible problem on linux-security before "bloodmask"
seems to have found it) with mount/umount has been in the libc
realpath() function failing to check bounds on the path parameter passed
to it.  This function ws duplicated with the identical code inside the
mount distribution, and then not used for some reason I don't
understand; in fact the code will compile cleanly if you simply rm
realpath.c from the mount distribution.  However since people are more
likely to upgrade their mount/umount code than libc, it is probably wise
at this point to leave a corrected version of realpath.c in the
distribution to avoid relying on a very likely broken libc.

For the mount distribution (from mount-util-linux-1.10.tar.gz), the diff
for a bounds checking realpath.c is:
82c82
<       strcpy(copy_path, path);
---
>       strncpy(copy_path, path, PATH_MAX);
165c165
<                       strcpy(copy_path, link_path);
---
>                       strncpy(copy_path, link_path, PATH_MAX);


You then need to add realpath to the Makefile:
62c62
< mount: mount.o fstab.o sundries.o version.o $(NFS_OBJS) $(LO_OBJS)
---
> mount: mount.o fstab.o sundries.o version.o realpath.o $(NFS_OBJS)
$(LO_OBJS)
65c65
< umount: umount.o fstab.o sundries.o version.o $(LO_OBJS)
---
> umount: umount.o fstab.o sundries.o version.o realpath.o $(LO_OBJS)
77a78,80
> realpath.o: realpath.c
>       $(COMPILE) $(RPC_CFLAGS) realpath.c



In the basically identical libc bsd/realpath.c code (looking at a 5.0.9
source tree, perhaps this was changed/fixed already in newer versions):

72c72
<       strcpy(copy_path, path);
---
>       strncpy(copy_path, path, PATH_MAX);
155c155
<                       strcpy(copy_path, link_path);
---
>                       strncpy(copy_path, link_path, PATH_MAX);


I believe this fixes the exploited buffer overflow in realpath.c, I would
of course encourage you to review the source code yourself for ANY program
you are going to add suid on your system.  Other problems that may exist
elsewhere in the mount/umount code I have not examined, as with any
program, if you do not have a specific need to run it suid root, don't.


Dave

--------------------------------+---------------------
       David J. Meltzer         | Email: davem () iss net
       Systems Engineer         |   Web:   www.iss.net
Internet Security Systems, Inc. |   Fax: (404)252-2427