openSUSE alert openSUSE-SU-2011:0174-1 (build) [LWN.net]

From:
    	       opensuse-security@opensuse.org 
To:
    	       opensuse-updates@opensuse.org 
Subject:
    	       openSUSE-SU-2011:0174-1 (moderate): build security update 
Date:
    	       Tue, 15 Mar 2011 16:08:15 +0100 (CET)
Message-ID:
    	       <20110315150815.1A772BE91@oldboy.suse.de>

   openSUSE Security Update: build security update
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2011:0174-1
Rating:             moderate
References:         #665768 
Cross-References:   CVE-2010-4226
Affected Products:
                    openSUSE 11.3
                    openSUSE 11.2
______________________________________________________________________________

   An update that fixes one vulnerability is now available. It
   includes one version update.

Description:

   The build script uses cpio to extract untrusted rpm
   packages for bootstrapping virtual machines. cpio is not
   safe to use for this task, therefore the build script now
   uses bsdtar instead (CVE-2010-4226).

Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 11.3:

      zypper in -t patch build-4028

   - openSUSE 11.2:

      zypper in -t patch build-4028

   To bring your system up-to-date, use "zypper patch".

Package List:

   - openSUSE 11.3 (noarch) [New Version: 2010.07.28]:

      build-2010.07.28-1.3.1
      build-mkbaselibs-2010.07.28-1.3.1

   - openSUSE 11.2 (noarch) [New Version: 2010.07.28]:

      build-2010.07.28-1.3.1

References:

   http://support.novell.com/security/cve/CVE-2010-4226.html
   https://bugzilla.novell.com/665768

to post comments

cpio not safe? Why not?

Posted Mar 17, 2011 9:39 UTC (Thu) by epa (subscriber, #39769) [Link] (3 responses)

Uh, 'cpio is not safe for this task'? What does it do wrong? Does this mean it is unsafe to use cpio to extract archives in general, unless they are from a trusted source?

I'm guessing it might be because cpio uncritically makes setuid programs, device files and so on. (Though running it as root would mitigate most of that, it could still create setuid programs owned by the current user.) Or is it because cpio has path traversal exploits with ../.. stuff in the archive filenames?

Whatever it is, it sounds a bit like the advisory and fix should be against cpio itself. Does someone have more details?

cpio not safe? Why not?

Posted Mar 17, 2011 13:27 UTC (Thu) by ferringb (subscriber, #20752) [Link] (2 responses)

Shitty CVE in terms of explanation, doesn't include my tar/cpio examples, nor does it make it clear that it basically allows arbitrary modification to the build node's root fs by via unpacking w/ root privs. You compromise the node, the next logical target is compromising all builds ran on it- a variation of the thompson attack. Note a proper selinux policy for the service likely could block the overwrite of root fs components although it still is a dicey situation to be in.

Short version, you can't trust multiple invocations of gnu tar, and you sure as hell cannot trust a single gnu cpio invocation to actually not climb out of current dir. The historical behaviour of tar is that if there is a preexisting sym that points at a dir, write to the dir; note gnutar creates syms as it's last step, thus it's a two step dance: a setup tarball to get symlinks to use for traversal, and a payload tarball that uses that link to climb out.

As for cpio, same thing, historical behaviour for it: play around with 'ln -s .. dir; touch ../outside-the-cwd; { echo dir; echo dir/outside-the-cwd; } | cpio --create' and remember that the archive is controllable by the attacker. To be clear, as long as OBS allows users to override the rpm/dpkg that's used w/in the build root, that means an attacker can customize the resultant pkg as needed (limited by whatever other protections there may be for inspecting the resultant pkg outside of the buildroot, thus the attackers, control).

Historically this is just how tar and cpio behave, known issue with them- you don't trust random tar/cpio archives basically. bsdtar has locked down path handling of it by default- you have to explicitly enable insecure handling via -P, thus their requirement you use it for vm's (chroot builders are trivial to break out of, thus don't require it).

cpio not safe? Why not?

Posted Mar 17, 2011 17:03 UTC (Thu) by epa (subscriber, #39769) [Link] (1 responses)

Thanks for the explanation. In general, then, you shouldn't use GNU tar or cpio for anything. (If you really do want to save symlinks into an archive and then extract them again, then maybe, but it's unlikely you want that.)

cpio not safe? Why not?

Posted Apr 18, 2011 16:05 UTC (Mon) by nix (subscriber, #2304) [Link]

You can use GNU tar. You just shouldn't use it to extract multiple tarballs in the same place under automatic control without scanning the extracted tree for out-of-tree symlinks after each invocation. (But this is a relatively rare use case for it anyway.)

From:		opensuse-security@opensuse.org
To:		opensuse-updates@opensuse.org
Subject:		openSUSE-SU-2011:0174-1 (moderate): build security update
Date:		Tue, 15 Mar 2011 16:08:15 +0100 (CET)
Message-ID:		<20110315150815.1A772BE91@oldboy.suse.de>