bugGNU Core Utilities - Bugs: bug #17427, CVE-2005-1039, chmod race in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #17427: CVE-2005-1039, chmod race in mkdir, mkfifo, mknod

Submitter:  None
Submitted:  Mon 14 Aug 2006 06:29:44 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Wont Fix
Privacy:  Public Assigned to:  None
Open/Closed:  Closed

Fri 25 Aug 2006 05:23:24 AM UTC, comment #1: 

[I also replied to the Debian bug list, but here's another copy.]

This patch doesn't look safe to me.  mkfifo and mknod should not open
device files or fifos, since this has undesirable side effects in some
cases.  For example, opening and then closing a tape drive might
rewind it.

As I wrote in April 2005, the original security issue is not a
vulnerability in coreutils; it's a problem inherent to the Unix model.
We cannot "fix" it by patching coreutils (and hundreds of other
utilities).  We must simply say: users cannot rely on directories that
are writeable by untrusted users, unless the directories are sticky
and are owned by trusted users.  Sorry, but that's life in the
Unix/Linux world.

That being said, mkdir can be made a bit "safer".  It cannot be made
completely "safe", though, in the sense that you're asking for, since
in some cases mkdir won't be able to read the newly-created directory
(and therefore can't open it) but POSIX still requires mkdir to chmod
it in this case.  Hence the patch you submitted here isn't quite
right, since it sometimes gives up when it shouldn't.  We have fixed
mkdir a different way in coreutils test version 6.1
<ftp://alpha.gnu.org/gnu/coreutils/coreutils-6.1.tar.gz>, so that it
uses fchmod if possible, and falls back on chmod otherwise.

Paul Eggert <eggert>
Group administrator
Mon 14 Aug 2006 06:29:44 AM UTC, original submission:  

Hello!

Attached is a patch to fix the race in mkdir, mkfifo, and mknod, as seen in CVE-2005-1039 when running with --mode.  It is the same as the patch sent to Debian, where other details and discussion can be found:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=304556

(sorry for the "anonymous" bug, Savanah doesn't appear to be delivering email to me today...  Please CC kees@outflux.net)

Thanks!

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #10533:  coreutils-chmod-race.patch added by None (3KiB - text/x-patch - PATCH: solve mkdir/mkfifo/mknod --mode chmod race)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 3 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2006-08-25 eggert StatusNone Wont Fix
    Open/ClosedOpen Closed
2006-08-14 None Attached File- Added coreutils-chmod-race.patch, #10533

Back to the top

Powered by Savane 3.13-4b48.
Corresponding source code