oss-sec mailing list archives
Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo
From: William Cohen <wcohen () redhat com>
Date: Sat, 30 Apr 2011 22:00:48 -0400
On 04/29/2011 02:16 PM, Jan Lieskovsky wrote:
Hello Josh, Steve, vendors, It was found that oprofile profiling system did not properly sanitize the content of event argument, provided to oprofile profiling control utility (opcontrol). If a local unprivileged user was authorized by sudoers file to run the opcontrol utility, they could use the flaw to escalate their privileges (execute arbitrary code with the privileges of the privileged system user, root). Different vulnerability than CVE-2006-0576. References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624212 [2] https://bugzilla.redhat.com/show_bug.cgi?id=700883 Could you allocate a CVE id for this? Thank you & Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team P.S.: Oprofile is not encouraged to be run under sudo, but still should not allow escalation of privileges.
I don't know if this is the best way to fix this issue, but attached is a patch that filters out all but alpha numeric characters and '_'. Feedback on the patch would be appreciated. -Will
Attachment:
oprof-sanitize.patch
Description:
Current thread:
- CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo Jan Lieskovsky (Apr 29)
- Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo William Cohen (May 01)
- Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo William Cohen (May 01)
- Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo Huzaifa Sidhpurwala (May 03)
- Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo William Cohen (May 10)
- Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo William Cohen (May 10)
- Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo Huzaifa Sidhpurwala (May 10)
- Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo Huzaifa Sidhpurwala (May 03)
- Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo Stephane Chauveau (May 03)
- Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo Josh Bressers (May 02)