Subject: Re: [vserver] Security issue: guest to host escape via TIOCSTI ioctl in vserver enter
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Thu, 8 Nov 2012 00:19:58 +0100

On Wed, Nov 07, 2012 at 09:53:02PM +0000, halfdog wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1

> Herbert Poetzl wrote:
>> On Wed, Nov 07, 2012 at 04:13:48PM +0000, halfdog wrote: Security 
>> testing showed that when an admin enters a vserver guest from 
>> interactive shell, a malicious user inside the guest can use this 
>> to execute commands on the host. ...

>>> TIOCSTI only works if enabled for a guest (VXC_TIOCSTI) so
>>> unless you have found a bug to circumvent this, I think
>>> Linux-VServer is not affected.

> That's strange, perhaps I made some mistake during testing with
> the packages from repo.psand.net. 

what kernel did you use for your tests?

> Is VXC_TIOCSTI enabled by default, how to check that it is
> really disabled. 

no, it shouldn't be enabled by default.
you can check it either via 'vattribute --get ...'
or by looking at the CCAPS in 'cat /proc/virtual/<xid>/status'

VXC_TIOCSTI is defined as 0x00000010, so it is bit #4

> And did you try to run the gdb-test? 

no, didn't try that yet

> Were there any errors attaching to the process or during exec?

> I'll try to run test-set again from completely fresh setup
> as soon as possible. (or do you have a completely sane test
> environment available?)

new default installation should be sane, but also note that
vserver <name> enter is only intended for emergency maintainance
and not for occasional visits to a running and working guest
(which you should better do via ssh)

in any case, if TIOCSTI is possible inside a guest without
VXC_TIOCSTI enabled, then there is a bug which needs to be fixed

best,
Herbert

>> [1]
>> http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/

> - --
> http://www.halfdog.net/
> PGP:

> 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)

> iEYEARECAAYFAlCa19wACgkQxFmThv7tq+7vQQCfXFqKlbudPXCANMPoE0TUuETK
> gC0Aniqjm0QRUIZdhyTBIQaxdbKw7KCO
> =8bfi
> -----END PGP SIGNATURE-----