Security
Checkpoint and restore for seccomp filters
The checkpoint/restore (C/R) feature of the kernel has had a long and twisty path—with several rewrites from scratch along the way—before finally getting merged in the form of C/R in user space (CRIU). There are still some kernel resources that cannot be handled by CRIU, though, including secure computing (seccomp) filters. A patch set from Tycho Andersen seeks to change that.
Seccomp filters are written using the Berkeley Packet Filter (BPF) language, which targets an in-kernel virtual machine—and which has increasingly outgrown its name. In any case, for seccomp filters to be saved and restored, there needs to be a way to provide information about them, and about the BPF programs attached to them, to user space. Some of that depends on figuring out how to determine "equality" between BPF programs (i.e. which programs have been inherited or copied from another).
As with other in-kernel BPF users, seccomp filters are converted to extended BPF (eBPF) internally. But there are plans to allow filters written in eBPF (rather than "classic" BPF) directly, which means that the eBPF verifier needs to be aware of a new type of program: BPF_PROG_TYPE_SECCOMP. So the first patch adds that type. Right now, seccomp filter programs cannot use some of the more advanced features of eBPF (notably maps), but that may eventually change. Meanwhile, BPF_PROG_TYPE_SECCOMP can be used to restrict the types of BPF programs that can be dumped, since the patches do not add support for maps, at least yet.
Next, the patches add a mechanism to actually dump an eBPF program, along with a bit of metadata (the GPL status of the program). The bpf() system call, using the new BPF_PROG_DUMP command, is used to accomplish that. The caller must provide a file descriptor for the program and a buffer of sufficient length to hold the instructions. The buffer is filled in; the number of (fixed-width) instructions and the GPL status of the program are returned as well.
But, how does one get a file descriptor for a BPF program? A sufficiently privileged program (i.e. has CAP_SYS_ADMIN) can call ptrace() on a process using the PTRACE_SECCOMP_GET_FILTER_FD command to get a file descriptor for the first seccomp filter attached. Subsequent filters can be accessed with PTRACE_SECCOMP_NEXT_FILTER and each can be dumped with bpf(BPF_PROG_DUMP, ...).
That just leaves one last piece of the puzzle: reading a seccomp filter program out of a file descriptor and attaching it to processes, which is needed for the restore operation. For that, Andersen has extended the seccomp() system call with a new operation: SECCOMP_MODE_FILTER_EBPF. In the patch set, that operation only handles a single new command, SECCOMP_EBPF_ADD_FD, but others will likely be added when seccomp filters can use more eBPF features. SECCOMP_EBPF_ADD_FD will add the filter associated with the file descriptor to the process's filter list.
It is all something of a complicated dance, but is similar in some ways to other CRIU save and restore dances. One unresolved issue is how to represent the hierarchy of filter programs, which can be inherited over fork() and clone() and shared in other ways. If that hierarchy is to be restored to the same state it had when a set of processes was checkpointed, some way to determine which programs are the same, thus are likely to have been inherited, needs to be provided. Restoring the hierarchy is needed so that changes to filter programs properly propagate throughout the hierarchy tree.
The kernel clearly knows which programs come from where as they get attached, but that information is not stored anywhere. An earlier version of the patch set added a "program ID" to the metadata that was dumped with the program, but there were complaints that it was leaking a kernel address into user space, which is a security hole. There was discussion about ways to either obfuscate the address or to maintain a simple counter for the ID, but Andersen dropped the ID from the second (and current) version of the patches.
Normally, kcmp() is used to determine if two kernel objects are the "same"; BPF maintainer Alexei Starovoitov believes that the KCMP_FILE comparison can be taught to do the right thing for BPF program file descriptors. But Andy Lutomirski would like to see the hierarchy be more explicit:
Representing the hierarchy was further discussed by Andersen and Lutomirski in a thread on the second version of the patch set. Lutomirski's use case has requirements that are beyond those needed for C/R. It seems that tracking the parent of a seccomp filter and using kcmp() to determine equality may be sufficient for both needs, though.
Another round or two of patches would seem likely before this feature is ready to be merged—for one thing, man page changes are needed for bpf() and seccomp(). As seccomp filters get used by more programs, a way to save and restore them will certainly be needed. Further refinements, for more complicated eBPF programs with maps, for example, can be expected as well. While this patch set is targeted at seccomp filters, the more general eBPF dumping problem will eventually need to be addressed as well.
Brief items
Security quotes of the week
My worry is that some corporate executives won't interpret the VW story as a cautionary tale involving just punishments for a bad mistake but will see it instead as a demonstration that you can get away with something like that for six years.
New vulnerabilities
apport: privilege escalation
| Package(s): | apport | CVE #(s): | CVE-2015-1338 | ||||
| Created: | September 24, 2015 | Updated: | September 30, 2015 | ||||
| Description: | From the Ubuntu advisory:
Halfdog discovered that Apport incorrectly handled kernel crash dump files. A local attacker could use this issue to cause a denial of service, or possibly elevate privileges. The default symlink protections for affected releases should reduce the vulnerability to a denial of service. | ||||||
| Alerts: |
| ||||||
cacti: cross-site scripting
| Package(s): | cacti | CVE #(s): | CVE-2015-2967 | ||||
| Created: | September 25, 2015 | Updated: | September 30, 2015 | ||||
| Description: | From the CVE entry: Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||||
| Alerts: |
| ||||||
chromium: information disclosure
| Package(s): | chromium | CVE #(s): | CVE-2015-1303 CVE-2015-1304 | ||||||||||||||||||||||||||||||||
| Created: | September 28, 2015 | Updated: | November 2, 2015 | ||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2015-1303: Cross-origin bypass in DOM. Credit to Mariusz Mlynski. - CVE-2015-1304: Cross-origin bypass in V8. Credit to Mariusz Mlynski. A remote attacker can bypass the cross-origin resource sharing policy, thus getting access to sensitive data. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
cyrus-imapd: largely unspecified
| Package(s): | cyrus-imapd | CVE #(s): | CVE-2015-8076 | ||||||||||||||||||||||||||||||||
| Created: | September 24, 2015 | Updated: | November 23, 2015 | ||||||||||||||||||||||||||||||||
| Description: | From the openSUSE advisory:
Security fix: handle urlfetch range starting outside message range See the Cyrus IMAP 2.4.18 Release Notes for additional information. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
libemail-address-perl: denial of service
| Package(s): | libemail-address-perl | CVE #(s): | CVE-2015-7686 | ||||||||
| Created: | September 30, 2015 | Updated: | November 28, 2016 | ||||||||
| Description: | From the Debian LTS advisory:
Pali Rohár discovered a possible DoS attack in any software which uses the Email::Address Perl module for parsing string input to a list of email addresses. By default Email::Address module, version v1.907 (and all before) tries to understand nestable comments in an input string with depth level 2. With specially crafted inputs, parsing nestable comments can become too slow and can cause high CPU load, freeze the application and end in Denial of Service. Because input strings for Email::Address module come from external sources (e.g. from email sent by an attacker) it is a security problem impacting on all software applications which parse email messages using the Email::Address Perl module. With this upload of libemail-address-perl, the default value of nestable comments has been set to depth level 1 (as proposed by upstream). Please note that this is not proper a fix, just a workaround for pathological inputs with nestable comments. | ||||||||||
| Alerts: |
| ||||||||||
lxc: apparmor policy bypass
| Package(s): | lxc | CVE #(s): | CVE-2015-1335 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | September 30, 2015 | Updated: | November 12, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the LXC mailing list:
When a container starts up, lxc sets up the container's initial fstree by doing a bunch of mounting, guided by the container configuration file. The container config is owned by the admin or user on the host, so we do not try to guard against bad entries. However, since the mount target is in the container, it's possible that the container admin could divert the mount with symbolic links. This could bypass proper container startup (i.e. confinement of a root-owned container by the restrictive apparmor policy, by diverting the required write to /proc/self/attr/current), or bypass the (path-based) apparmor policy by diverting, say, /proc to /mnt in the container. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
moodle: multiple vulnerabilities
| Package(s): | moodle | CVE #(s): | CVE-2015-5264 CVE-2015-5265 CVE-2015-5266 CVE-2015-5267 CVE-2015-5268 CVE-2015-5269 | ||||||||||||
| Created: | September 24, 2015 | Updated: | September 30, 2015 | ||||||||||||
| Description: | From the Mageia advisory:
In Moodle before 2.8.8, completed and graded lesson activity was not protected against making new attempts to answer some questions, so students could re-attempt answering questions in the lesson (CVE-2015-5264). In Moodle before 2.8.8, users could delete files uploaded by other users in wiki (CVE-2015-5265). In Moodle before 2.8.8, meta course synchronisation enrols suspended students as managers for a short period of time and causes large database growth. On large installations, when the sync script takes a long time, suspended students may get assigned a manager role in meta course for several minutes (CVE-2015-5266) In Moodle before 2.8.8, password recovery tokens can be guessed because of php randomisation limitations (CVE-2015-5267). In Moodle before 2.8.8, when viewing ratings, the group access was not properly checked, allowing users from other groups to view ratings (CVE-2015-5268). In Moodle before 2.8.8, capability to manage groups does not have XSS risk, however it was possible to add XSS to the grouping description (CVE-2015-5269). | ||||||||||||||
| Alerts: |
| ||||||||||||||
NVIDIA graphics drivers: privilege escalation
| Package(s): | NVIDIA graphics drivers | CVE #(s): | CVE-2015-5950 | ||||||||
| Created: | September 28, 2015 | Updated: | October 26, 2015 | ||||||||
| Description: | From the Ubuntu advisory:
Dario Weisser discovered that the NVIDIA graphics drivers incorrectly handled certain IOCTL writes. A local attacker could use this issue to possibly gain root privileges. | ||||||||||
| Alerts: |
| ||||||||||
php5: multiple vulnerabilities
| Package(s): | php5 | CVE #(s): | CVE-2015-6831 CVE-2015-6832 CVE-2015-6833 | ||||||||||||||||||||||||||||||||||||
| Created: | September 25, 2015 | Updated: | September 30, 2015 | ||||||||||||||||||||||||||||||||||||
| Description: | From the SUSE advisory: CVE-2015-6831 - A use after free vulnerability in unserialize() has been fixed which could be used to crash php or potentially execute code. CVE-2015-6832 - A dangling pointer in the unserialization of ArrayObject items could be used to crash php or potentially execute code. CVE-2015-6833 - A directory traversal when extracting ZIP files could be used to overwrite files outside of intended area. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
php-ZendFramework2: code execution
| Package(s): | php-ZendFramework2 | CVE #(s): | |||||||||
| Created: | September 25, 2015 | Updated: | September 30, 2015 | ||||||||
| Description: | From the Fedora advisory: ZF2015-07: The filesystem storage adapter of Zend\Cache was creating directories with a liberal umask that could lead to local arbitrary code execution and/or local privilege escalation. | ||||||||||
| Alerts: |
| ||||||||||
pixman: buffer overflow
| Package(s): | pixman | CVE #(s): | |||||||||||||||||
| Created: | September 28, 2015 | Updated: | December 13, 2016 | ||||||||||||||||
| Description: | From the X.org advisory:
A new pixman release 0.32.8 is now available. This is a stable release that contains an important bug fix (buffer overflow), which can affect 32-bit systems. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
rolekit: information leak
| Package(s): | rolekit | CVE #(s): | |||||
| Created: | September 28, 2015 | Updated: | September 30, 2015 | ||||
| Description: | From the Fedora advisory:
rolekit-0.3.2-2.fc22 - Fix permissions on role JSON settings files to avoid leaking sensitive info | ||||||
| Alerts: |
| ||||||
shutter: code execution
| Package(s): | shutter | CVE #(s): | CVE-2015-0854 | ||||||||||||
| Created: | September 24, 2015 | Updated: | January 2, 2017 | ||||||||||||
| Description: | From the Mageia advisory:
In the "Shutter" screenshot application, it was discovered that using the "Show in folder" menu option while viewing a file with a specially-crafted path allows for arbitrary code execution with the permissions of the user running Shutter (CVE-2015-0854). | ||||||||||||||
| Alerts: |
| ||||||||||||||
simplestreams: denial of service
| Package(s): | simplestreams | CVE #(s): | CVE-2015-1337 | ||||||||
| Created: | September 25, 2015 | Updated: | September 30, 2015 | ||||||||
| Description: | From the Ubuntu advisory: It was discovered that Simple Streams did not properly perform gpg verification in some situations. A remote attacker could use this to perform a man-in-the-middle attack and inject malicious content into the stream. | ||||||||||
| Alerts: |
| ||||||||||
unity-firefox-extension, webapps-greasemonkey, webaccounts-browser-extension: denial of service
| Package(s): | unity-firefox-extension, webapps-greasemonkey, webaccounts-browser-extension | CVE #(s): | |||||
| Created: | September 25, 2015 | Updated: | September 30, 2015 | ||||
| Description: | From the Ubuntu advisory: Future Firefox updates will require all addons be signed and unity-firefox-extension, webapps-greasemonkey and webaccounts-browser-extension will not go through the signing process. Because these addons currently break search engine installations, this update permanently disables the addons by removing them from the system. | ||||||
| Alerts: |
| ||||||
virtualbox-ose: multiple vulnerabilities
| Package(s): | virtualbox-ose | CVE #(s): | CVE-2014-2486 CVE-2014-2488 CVE-2014-2489 | ||||
| Created: | September 29, 2015 | Updated: | September 30, 2015 | ||||
| Description: | From the CVE entries:
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and availability via unknown vectors related to Core. (CVE-2014-2486) Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect confidentiality via unknown vectors related to Core. (CVE-2014-2488) Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core. (CVE-2014-2489) | ||||||
| Alerts: |
| ||||||
wireshark: multiple vulnerabilities
| Package(s): | wireshark | CVE #(s): | CVE-2015-6241 CVE-2015-6242 CVE-2015-6243 CVE-2015-6244 CVE-2015-6245 CVE-2015-6246 CVE-2015-6247 CVE-2015-6248 CVE-2015-6249 | ||||||||||||||||||||||||||||||||||||||||
| Created: | September 25, 2015 | Updated: | October 7, 2015 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries: CVE-2015-6241 - The proto_tree_add_bytes_item function in epan/proto.c in the protocol-tree implementation in Wireshark 1.12.x before 1.12.7 does not properly terminate a data structure after a failure to locate a number within a string, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2015-6242 - The wmem_block_split_free_chunk function in epan/wmem/wmem_allocator_block.c in the wmem block allocator in the memory manager in Wireshark 1.12.x before 1.12.7 does not properly consider a certain case of multiple realloc operations that restore a memory chunk to its original size, which allows remote attackers to cause a denial of service (incorrect free operation and application crash) via a crafted packet. CVE-2015-6243 - The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the (1) dissector_get_string_handle and (2) dissector_get_default_string_handle functions. CVE-2015-6244 - The dissect_zbee_secure function in epan/dissectors/packet-zbee-security.c in the ZigBee dissector in Wireshark 1.12.x before 1.12.7 improperly relies on length fields contained in packet data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2015-6245 - epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. CVE-2015-6246 - The dissect_wa_payload function in epan/dissectors/packet-waveagent.c in the WaveAgent dissector in Wireshark 1.12.x before 1.12.7 mishandles large tag values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2015-6247 - The dissect_openflow_tablemod_v5 function in epan/dissectors/packet-openflow_v5.c in the OpenFlow dissector in Wireshark 1.12.x before 1.12.7 does not validate a certain offset value, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. CVE-2015-6248 - The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2015-6249 - The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.7 does not prevent the conflicting use of a table for both IPv4 and IPv6 addresses, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
xpra: information disclosure
| Package(s): | xpra | CVE #(s): | |||||||||
| Created: | September 28, 2015 | Updated: | September 30, 2015 | ||||||||
| Description: | From the Fedora advisory:
This update fixes a critical bug with the Xdummy setup which allows local users to access the virtual display used for the xpra sessions. xpra-0.15.6-1.fc21 - Update to 0.15.6 xpra-0.15.6-1.fc22 - Update to 0.15.6 xpra-0.15.6-1.fc23 - Update to 0.15.6 | ||||||||||
| Alerts: |
| ||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>