Re: Busybox on musl is affected by CVE-2015-1817

[Rich Felker <dalias@libc.org>]

On Tue, Mar 31, 2015 at 09:07:19PM +0200, Denys Vlasenko wrote:
> On Mon, Mar 30, 2015 at 7:31 AM, Rich Felker <dalias@libc.org> wrote:
> > For details on CVE-2015-1817, see:
> > http://www.openwall.com/lists/musl/2015/03/30/1
> >
> > With musl-linked Busybox installed setuid and ping enabled, exploiting
> > this issue is trivial.
> >
> > While CVE-2015-1817 is certainly musl's fault, there are two changes
> > to Busybox I'd like to propose that would have prevented it from being
> > exploitable:
> >
> > 1. Having setuid utilities like ping obtain the resource they need (in
> >    the case of ping, SOCK_RAW) without processing user input at all,
> >    then fully dropping root (setuid(getuid())) before doing anything.
> >    This has been standard practice for setuid programs since the 90s
> >    and it feels bad that busybox is not doing it.
> 
> In general this is acceptable, but with this particular case
> and CVE, it wouldn't help.

Sure it does.

> create_icmp_socket(lsa) needs to know of which address family
> the socket should be:
> 
>         if (lsa->u.sa.sa_family == AF_INET6)
>                 sock = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
>         else
>                 sock = socket(AF_INET, SOCK_RAW, 1); /* 1 == ICMP */
> 
> This is only known after HOST is parsed.
> And CVE is in DNS resolving code :(

The solution is simple: create both raw sockets and close the one you
don't need later. There's probably also a way to use the AF_INET6 raw
socket or IPv4 ping, but I don't know right off.

> > 2. Reconsider the rejection of the patch to add SOCK_DGRAM support for
> >    ping, which allows it to run without root.
> 
> This seems to lead to a significantly larger code.

I don't recall the exact amount, but given that busybox's suid
framework is not taking any precautions to mitigate the risks of suid
(not to mention that eliminating all suids is a goal of some
security-conscious systems integrators) I think it would be worth it
even if it doubled the size of the ping utility (which it does not).

Rich