Bugzilla – Bug 952680
VUL-0: CVE-2015-7723: fglrx: Privilege Escalation Via Symlink Attacks On POSIX Shared Memory With Insecure Permissions In AMD fglrx-driver
Last modified: 2016-08-08 12:34:21 UTC
via FD http://seclists.org/fulldisclosure/2015/Oct/104 Vulnerability title: Privilege Escalation Via Symlink Attacks On POSIX Shared Memory With Insecure Permissions In AMD fglrx-driver CVE: CVE-2015-7723 Vendor: AMD Product: fglrx-driver Affected version: 14.4.2 Fixed version: 15.7 Reported by: Tim Brown Details: It has been identified that the userland portion of the fglrx-driver utilised by Xorg allows privilege escalation via symlink attacks on POSIX shared memory with insecure permissions. On systems with a Linux kernel where fs.protected_symlinks is not set to 1, or where this feature is not available, the following code (present in libaticaldd.so and fglrx_dri.so) calls shm_open() with insecure flags specified which allows the Linux kernel to follow an existent symlink under /dev/shm: mov $0x1b6,%edx ; $edx (mode) = 0666 mov $0x42,%esi ; $esi (oflag) = O_CREAT | O_RDWR - missing O_EXCL mov %r13,%rdi callq 208b68 <shm_open@plt> The same call to shm_open() requests that the permissions of newly created file are 0666 and as a result, an arbitrary file, owned by root, with permissions of 0666 can be created anywhere on the filesystem Furthermore, the code then proceeds to force the permissions on the resultant file to 0666 using fchmod(). This can be useful if the symlink target already exists: mov $0x1b6,%esi ; $esi (mode) = 0666 mov %eax,%edi callq 209058 <fchmod@plt> Further details at: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-7723/ Copyright: Copyright (c) Portcullis Computer Security Limited 2015, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited. #####################################################################################
SUSE is currently investigating how an update to this driver can be issued without breaking certain hardware.
This issue should have been addressed in latest Catalyst driver. Isn't it?
(In reply to Jammy Zhou from comment #5) > This issue should have been addressed in latest Catalyst driver. Isn't it? If you are referring to the security issues, yes. But we are blocked by bug 934405 comment #73, and it is about compatibility. Updating the driver to the latest version previously broke hardware that worked with earlier versions, and the maintainers claims that the required information is not available. I understand that this information is currently being requested internally.
Note that this bug is mitigated on SLE12 and sle11SP4 by fs symlink and hardlink protection.
Better let's give up on bugs filed against the "old" fglrx driver. AFAIK it is no longer in development and is currently replaced by a new driver developed by a different team. The driver will make use of libglvnd - as Mesa meanwhile does and NVIDIA since some time. In addition apparently AMD isn't even able to replace any driver package. So even if things would be fixed, it could not be fixed in the repository.