Subject: Security issue: guest to host escape via TIOCSTI ioctl in vserver enter
From: halfdog <me@halfdog.net>
Date: Wed, 07 Nov 2012 16:13:48 +0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Security testing showed that when an admin enters a vserver guest from
interactive shell, a malicious user inside the guest can use this to
execute commands on the host. The current POC requires gdb to be
installed, but it should be quite easy to write a small custom
ptrace-program for that task. Risk rating should consider, that this
vulnerability usually requires root privileges in guest to exploit,
unless it is combined with similar "su" vulnerability, e.g. when
performing "vserver xxx enter", "su postgres". See [1] for more
information.

hd


[1] http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAlCagIUACgkQxFmThv7tq+5B7QCgg1IGcHVzYPYQOxS+QpIeokUB
fIAAnRiHCGgNpKuCMQ2GKMje2xG5uZ3q
=FCX1
-----END PGP SIGNATURE-----