bugGNU Screen - Bugs: bug #45582, Race condition creating the socket...

 
 

bug #45582: Race condition creating the socket directories

Submitted by:  None
Submitted on:  Mon 20 Jul 2015 08:27:17 AM UTC  
 
Category: Program LogicSeverity: 3 - Normal
Priority: 5 - NormalStatus: None
Privacy: PublicAssigned to: None
Open/Closed: OpenRelease: 4.2.0
Fixed Release: NonePlanned Release: None
Work Required: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 20 Jul 2015 11:22:43 AM UTC, comment #3:

Well the problem is that it might be that there is no user involved. If "screen" is used to keep the console of a daemon process open, then simply failing will fail the startup of the daemon process.

I don't see any difference in handling the directory creation evaluating the EEXIST flag or not. I any case some other process can steal the directory, where this instance of "screen" created the directory or not.

Jens Reimann <ctron>
Mon 20 Jul 2015 10:44:35 AM UTC, comment #2:

The race mentioned here, is that screen refuses to start, when the SockPath or SockDir is created by another process in a very specifc moment. Nothing bad actually happens, user can retry.

Another possible race is that some malicious code tries to
swap directories in the right moment so that screen would do write(), chmod(), chown()... on other files/directories than intended.
If such a race succeeds, it could be used to exploit the suid bit that screen has on some systems to gain access to otherwise inaccessible data or corrupt other data.

Swapping directories can be done very fast by flipping symlinks back and forth.

I see the user friendly effect of not aborting, when everything is okay. But I also see the danger that patching the code to be more permissive during startup, might open the gap for such exploits. Beware!

Juergen Weigert <jnweiger>
Project Administrator
Mon 20 Jul 2015 08:31:03 AM UTC, comment #1:

Adding myself to CC.

Jens Reimann <ctron>
Mon 20 Jul 2015 08:27:17 AM UTC, original submission:

There is a race condition in screen creating the socket directories.

Both the main and the user specific directory (child to the main) suffer from the same type of race condition.

Taken from "screen.c" (version 4.1.0 of Ubuntu, but the same for 4.2), creating the child obviously got patched:

-----------
sprintf(SockPath, "%s/S-%s", SockDir, LoginName);
if (access(SockPath, F_OK))
{
if (mkdir(SockPath, 0700) == -1 && errno != EEXIST)
Panic(errno, "Cannot make directory '%s'", SockPath);
(void) chown(SockPath, real_uid, real_gid);
}
}
-----------

However a few lines up, creating the parent directory is still suffering from the race condition:

-----------
if (stat(SockDir, &st))
{
n = (eff_uid == 0 && (real_uid || eff_gid == real_gid)) ? 0755 :
(eff_gid != real_gid) ? 0775 :
#ifdef S_ISVTX
0777|S_ISVTX;
#else
0777;
#endif

// START: !!

if (mkdir(SockDir, n) == -1)
Panic(errno, "Cannot make directory '%s'", SockDir);

// END: !!
}

-----------

If the screen tool is started at the same time, then between the "stat" call and the "mkdir" call it may happen that that another instance of screen already created the directory. Causing the second "mkdir" to fail with "EEXIST". Which is "ok", since the directory simple has to be there.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jnweiger (Posted a comment)
  • -unavailable- added by ctron (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 20 Jul 2015 08:31:19 AM UTCctronCarbon-CopyRemoved -unavailable-=>-
    Mon 20 Jul 2015 08:31:03 AM UTCctronCarbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1