Subject: Re: [vserver] Security issue: guest to host escape via TIOCSTI ioctl in vserver enter
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Sat, 10 Nov 2012 19:46:55 +0100

On Sat, Nov 10, 2012 at 03:49:21PM +0000, halfdog wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1

> Herbert Poetzl wrote:
>> On Wed, Nov 07, 2012 at 09:53:02PM +0000, halfdog wrote: Herbert
>> Poetzl wrote:
>>>> On Wed, Nov 07, 2012 at 04:13:48PM +0000, halfdog wrote:
>>>> Security
>>>>> testing showed that when an admin enters a vserver guest from
>>>>>  interactive shell, a malicious user inside the guest can use
>>>>> this to execute commands on the host. ...

>>>> TIOCSTI only works if enabled for a guest (VXC_TIOCSTI) so 
>>>> unless you have found a bug to circumvent this, I think 
>>>> Linux-VServer is not affected.

>> no, it shouldn't be enabled by default. you can check it either via
>> 'vattribute --get ...' or by looking at the CCAPS in 'cat
>> /proc/virtual/<xid>/status' VXC_TIOCSTI is defined as 0x00000010,
>> so it is bit #4

> I think, Corey did a perfect analysis, so issue is confirmed by
> source analsis.

> Just for the records, Herbert you were right regarding caps:
> VXC_TIOCSTI is not enabled by default (secure default),

> although stat allows guest to detect all available ptys
> on host and guest (compare guest "ls /dev/pts/" to "stat
> /dev/pts/[num]" where num is valid on host but not visible to
> guest)

that sounds interesting, thanks for the info, will look into
it where this check is missing (i.e. probably will be fixed soon)

> I have not found any other ways to manipulate ttys
> using TIOCSTI or other methods, nor within or between guests.

good, so I can assume that we are safe in regards to TIOCSTI
but I'll think about disabling it in general or per guest for
the next release to make it even safer ...

thanks,
Herbert

> # cat /proc/virtual/40000/status
> UseCnt: 5
> Tasks:  2
> Flags:  0000001602020010
> BCaps:  ffffffffb44c04ff
> CCaps:  0000000000004101
> Umask:                 0
> Wmask:                 0
> Spaces: 0c020200 00020200

> hd

> - -- 
> http://www.halfdog.net/
> PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)

> iEYEARECAAYFAlCed3QACgkQxFmThv7tq+5j5gCdFo5yBqPrpx6+qc6bf0psNk9m
> R5kAnAlrtpRF5g81zJZyJNRZXzoM7y7F
> =tRzk
> -----END PGP SIGNATURE-----