From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/14770 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Re: posix_spawn Date: Tue, 1 Oct 2019 07:42:46 -0400 Message-ID: <20191001114246.GC16318@brightrain.aerifal.cx> References: <20190930223632.GW9017@brightrain.aerifal.cx> <20191001022102.GA16318@brightrain.aerifal.cx> <20191001025543.GB16318@brightrain.aerifal.cx> <87pnjhvtch.fsf@oldenburg2.str.redhat.com> Reply-To: musl@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="111078"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Mutt/1.5.21 (2010-09-15) Cc: Joshua Hudson , musl@lists.openwall.com To: Florian Weimer Original-X-From: musl-return-14786-gllmg-musl=m.gmane.org@lists.openwall.com Tue Oct 01 13:43:08 2019 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.89) (envelope-from ) id 1iFGYe-000Skw-DY for gllmg-musl@m.gmane.org; Tue, 01 Oct 2019 13:43:08 +0200 Original-Received: (qmail 1129 invoked by uid 550); 1 Oct 2019 11:43:03 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 1106 invoked from network); 1 Oct 2019 11:43:03 -0000 Content-Disposition: inline In-Reply-To: <87pnjhvtch.fsf@oldenburg2.str.redhat.com> Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:14770 Archived-At: On Tue, Oct 01, 2019 at 09:05:18AM +0200, Florian Weimer wrote: > * Rich Felker: > > > This is not safe and creates a false sense that something broken might > > work. Moreover it's a vulnerability to use it this way. You have a > > window where different tasks sharing VM space are executing with > > different privilege levels, and thereby one is able to seize execution > > of the other and achieve its privilege level. > > That's a non-sequitur. A shared address space does not necessarily mean > that execution under one set of credentials will have unrestricted > effects on executions under different credentials within the same > address space. It does, but not necessarily in all circumstances. The case in which is it dangerous is when one of the tasks is "dropping privileges" before executing code that either intentionally (e.g. a login session, script interpreter, etc. acting behalf of the new user) or unintentionally (because the code after dropping privileges is not as heavily scrutinized and has a vulnerability) lets the attacker execute code they control. In that case, the now-attacker-controlled task can perform operations on the VM space of the privileged task, e.g. using mmap to replace the code it's executing with whatever it wants. This issue is why it's so important that setuid, etc. not return before all threads have been confirmed to have completed the operation (just queuing or initiating it for them all is not enough). Rich