Subject: Re: [vserver] Security issue: guest to host escape via TIOCSTI ioctl in vserver enter
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 7 Nov 2012 21:54:51 +0100

On Wed, Nov 07, 2012 at 04:13:48PM +0000, halfdog wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1

> Security testing showed that when an admin enters a vserver guest from
> interactive shell, a malicious user inside the guest can use this to
> execute commands on the host. The current POC requires gdb to be
> installed, but it should be quite easy to write a small custom
> ptrace-program for that task. Risk rating should consider, that this
> vulnerability usually requires root privileges in guest to exploit,
> unless it is combined with similar "su" vulnerability, e.g. when
> performing "vserver xxx enter", "su postgres". See [1] for more
> information.

TIOCSTI only works if enabled for a guest (VXC_TIOCSTI)
so unless you have found a bug to circumvent this, I
think Linux-VServer is not affected.

thanks for the info though!

best,
Herbert

> hd


> [1] http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/

> - -- 
> http://www.halfdog.net/
> PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)

> iEYEARECAAYFAlCagIUACgkQxFmThv7tq+5B7QCgg1IGcHVzYPYQOxS+QpIeokUB
> fIAAnRiHCGgNpKuCMQ2GKMje2xG5uZ3q
> =FCX1
> -----END PGP SIGNATURE-----