New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 799705 link

Starred by 1 user
Status: Verified
Owner:
█ yunlian@chromium.org
Last visit > 30 days ago
Closed: Jan 2018
Cc:
█ yunlian@chromium.org
kerrnel@chromium.org
█ sawlani@google.com
allenwebb@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug-Security

Blocked on:
issue 800007
Blocking:
issue 800007



Sign in to add a comment

CrOS: Vulnerability reported in sys-libs/glibc

Project Member Reported by vomit.go...@appspot.gserviceaccount.com, Jan 6 2018 
Automated analysis has detected that the following third party packages have had vulnerabilities publicly reported. 

NOTE: There may be several bugs listed below - in almost all cases, all bugs can be quickly addressed by upgrading to the latest version of the package.

Package Name: sys-libs/glibc
Package Version: [cpe:/a:gnu:glibc:2.23]

Advisory: CVE-2017-16997
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2017-16997
  CVSS severity score: 9.3/10.0
  Confidence: high
  Description:

elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.

Comment 1 by allenwebb@chromium.org, Jan 8 2018

Cc: allenwebb@chromium.org
Labels: Security_Severity-Low
Status: Available (was: Untriaged)
I ran a script to run lddtree -vx on all the binaries in an amd64-generic ToT CrOS image and have included the set of unique values for runpath below. Note that u'' is not listed so we shouldn't be directly affected by this issue.

  ldpaths[runpath] = []
  ldpaths[runpath] = [u'/tmp/m/opt/google/chrome']
  ldpaths[runpath] = [u'/tmp/m/usr/bin/lib']
  ldpaths[runpath] = [u'/tmp/m/usr/sbin/lib']
  ldpaths[runpath] = [u'/usr/lib64']
  ldpaths[runpath] = [u'/usr/lib64/binutils/x86_64-cros-linux-gnu/2.27.0']
  ldpaths[runpath] = [u'/usr/lib64/elfutils']
  ldpaths[runpath] = [u'/usr/lib64/ipsec']
  ldpaths[runpath] = [u'/usr/lib64/ldb', u'/usr/lib64']
  ldpaths[runpath] = [u'/usr/lib64/perl5/5.24.0/x86_64-linux/CORE']
  ldpaths[runpath] = [u'/usr/lib64/samba']
  ldpaths[runpath] = [u'/usr/lib64/samba', u'/usr/lib64']
  ldpaths[runpath] = [u'/usr/lib64/tevent', u'/usr/lib64']
  ldpaths[runpath] = [u'/usr/libexec/sudo']

Comment 2 by vapier@chromium.org, Jan 8 2018

Owner: yunlian@chromium.org
yeah i don't think this has an impact on us.  CL is up here:
  https://chromium-review.googlesource.com/854769
Project Member

Comment 3 by sheriffbot@chromium.org, Jan 9 2018

Labels: -Pri-1 Pri-2
Project Member

Comment 4 by sheriffbot@chromium.org, Jan 9 2018

Status: Assigned (was: Available)

Comment 5 by yunlian@chromium.org, Jan 10 2018

Blockedon: 800007

Comment 6 by yunlian@chromium.org, Jan 10 2018

Blocking: 800007

Comment 7 by yunlian@chromium.org, Jan 10 2018

Cc: sawlani@google.com

Comment 8 by sawlani@google.com, Jan 11 2018 

Lakitu has two binaries which has rpath set to $ORIGIN
/usr/lib64/gconv/UHC.so and  /usr/lib64/gconv/JOHAB.so

Comment 9 by sawlani@google.com, Jan 11 2018 

Fortunately lakitu has two setuid binaries:
/usr/bin/sudo and /usr/libexec/dbus-daemon-launch-helper both of which are not linked with gconv libraries. 

If my understanding is correct, bug only impacts for binaries which have setuid bit set and RPATH set to $ORIGIN.

Based on above, I think there is no need for backporting the changes to stable* branches. Only updating head should suffice.

Comment 10 by kerrnel@chromium.org, Jan 30 2018

Cc: yunlian@chromium.org kerrnel@chromium.org
yunlian@, is 800007 fixed and if so, is this fixed as well based on https://chromium-review.googlesource.com/c/chromiumos/overlays/chromiumos-overlay/+/854769?

I'd like to clean up the security bug queue.

Comment 11 by yunlian@chromium.org, Jan 30 2018

Status: Fixed (was: Assigned)
Yes, it is fixed based on that CL.
Project Member

Comment 12 by sheriffbot@chromium.org, Feb 8 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify

Comment 13 by mbarbe...@chromium.org, Mar 12 2018

Components: OS>Packages

Comment 14 by yunlian@chromium.org, Mar 19 2018

Status: Verified (was: Fixed)
Project Member

Comment 15 by sheriffbot@chromium.org, May 9 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment