On Wed, Nov 07, 2012 at 09:53:02PM +0000, halfdog wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > Herbert Poetzl wrote: >> On Wed, Nov 07, 2012 at 04:13:48PM +0000, halfdog wrote: Security >> testing showed that when an admin enters a vserver guest from >> interactive shell, a malicious user inside the guest can use this >> to execute commands on the host. ... >>> TIOCSTI only works if enabled for a guest (VXC_TIOCSTI) so >>> unless you have found a bug to circumvent this, I think >>> Linux-VServer is not affected. > That's strange, perhaps I made some mistake during testing with > the packages from repo.psand.net. what kernel did you use for your tests? > Is VXC_TIOCSTI enabled by default, how to check that it is > really disabled. no, it shouldn't be enabled by default. you can check it either via 'vattribute --get ...' or by looking at the CCAPS in 'cat /proc/virtual/<xid>/status' VXC_TIOCSTI is defined as 0x00000010, so it is bit #4 > And did you try to run the gdb-test? no, didn't try that yet > Were there any errors attaching to the process or during exec? > I'll try to run test-set again from completely fresh setup > as soon as possible. (or do you have a completely sane test > environment available?) new default installation should be sane, but also note that vserver <name> enter is only intended for emergency maintainance and not for occasional visits to a running and working guest (which you should better do via ssh) in any case, if TIOCSTI is possible inside a guest without VXC_TIOCSTI enabled, then there is a bug which needs to be fixed best, Herbert >> [1] >> http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/ > - -- > http://www.halfdog.net/ > PGP: > 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.11 (GNU/Linux) > iEYEARECAAYFAlCa19wACgkQxFmThv7tq+7vQQCfXFqKlbudPXCANMPoE0TUuETK > gC0Aniqjm0QRUIZdhyTBIQaxdbKw7KCO > =8bfi > -----END PGP SIGNATURE-----