-
Notifications
You must be signed in to change notification settings - Fork 235
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE-2017-5226 -- bubblewrap escape via TIOCSTI ioctl #142
Comments
This prevents the sandboxed code from getting a controlling tty, which in turn prevents it from accessing the TIOCSTI ioctl and hence faking terminal input. Fixes: containers#142
Calling setsid() appears to be sufficient to avoid this, if we are willing to sacrifice tty job control for the sandboxed processes. With a slightly modified exploit that calls perror() if the ioctl fails:
I'm going to apply that in Debian for now. |
This is arguably not a vulnerability in Bubblewrap itself, because it does not give the user calling Bubblewrap any more privileges outside the sandbox than they had inside. However, I think it is correct to treat it as a vulnerability in Flatpak, and in any other sandboxes based on Bubblewrap that might be invoked with a controlling terminal. |
I should note here for completeness that at least one member of the Debian security team seems to think this and its clones (CVE-2005-4890, CVE-2016-7545, CVE-2016-2781, CVE-2016-2779, CVE-2016-2568) are really all examples of one kernel issue, namely "TIOCSTI should be a privileged operation". https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850702#27 |
Note that we do not call `setsid()` just yet because it messes with job control in some applications, so we leave it disabled for now. Ideally, we would use an alternative approach, likely with `seccomp`, to achieve this. For more details, see: * Discussion: containers/bubblewrap#142 * Flatpak's solution: flatpak/flatpak@902fb71
Am I right that this is not an issue when |
I think that's correct. However, you don't need to trust me on this - you can try the sample exploit in your environment, and find out. |
…5226 Without it, it is possible to escape the sandbox via TIOCSTI ioctls on the session PTY. Related: containers/bubblewrap#555 Related: containers/bubblewrap#142 Related: https://news.ycombinator.com/item?id=30825088 Signed-off-by: Ariadne Conill <[email protected]>
…-5226) Bubblewrap has an under-documented option which helps to protect against abuse of TIOCSTI ioctls against the session PTY to escape the build sandbox, the --new-session option. Related: containers/bubblewrap#555 Related: containers/bubblewrap#142 Related: https://news.ycombinator.com/item?id=30825088 Signed-off-by: Ariadne Conill <[email protected]>
On Debian bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850702, Federico Bento <[email protected]> writes:
I don't know who assigned the CVE ID or whether the bug reporter has made any attempt to report it upstream already.
The text was updated successfully, but these errors were encountered: