Issue metadata
Sign in to add a comment
|
Potential root privilege escalation via debugd |
||||||||||||||||||||||
Issue descriptionSpin-off from issue 817920 : There is a missing \ character in capture_utility.sh [6] which causes the value of ht_location to be executed. This binary can be called via debugd's dbus interface [7] by any user [8], regardless of whether or not the machine is in dev mode. The injection forces the executed binary to have the following 3 arguments: "!= below ]". If the executed binary is 'vi', execution will not fail, after which the vi ':!' command can be used to execute an external command as root. This has been automated and attached in the script privesc.sh. When executed from crosh this script will return an interactive root shell.
,
Mar 2 2018
,
Mar 2 2018
,
Mar 2 2018
,
Mar 5 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform2/+/09bcd233c57a5d7b4435935a5e5ad90c06061d1d commit 09bcd233c57a5d7b4435935a5e5ad90c06061d1d Author: Mattias Nissler <mnissler@chromium.org> Date: Mon Mar 05 15:08:06 2018 debugd: Fix command injection in capture_utility.sh Due to an incorrectly broken line in a conditional, the --ht-location parameter could be abused for command injection BUG= chromium:818135 TEST=Manual Change-Id: I795077dced66696354038fc79d37f521575de08f Reviewed-on: https://chromium-review.googlesource.com/945914 Commit-Ready: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> [modify] https://crrev.com/09bcd233c57a5d7b4435935a5e5ad90c06061d1d/debugd/src/helpers/capture_utility.sh
,
Mar 5 2018
,
Mar 6 2018
,
Mar 27 2018
,
May 1 2018
,
May 30 2018
,
Jun 12 2018
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jun 15 2018
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by mnissler@chromium.org
, Mar 2 2018Status: Started (was: Unconfirmed)