[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110312170344.GA14833@albatros>
Date: Sat, 12 Mar 2011 20:03:45 +0300
From: Vasiliy Kulikov <segoon@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Untrusted fs and invalid filenames
This is a resumption of the subject "Physical access vulnerabilities and
auto-mounting" brought by Dan Rosenberg. The previous discussion was
about possible attacks the kernel, now I'd like to talk about attacks
userland programs.
While POSIX restricts the character set used in filenames, some Linux
filesystems (at least ext2) permit reserved filenames ".", ".." and
filenames with "/" inside. I have a crafted flash drive with ext2 that
has such files:
root@...atros:/media# ls cdrom/ -la
итого 28
drwxr-xr-x 4 root root 4096 2011-03-12 18:55 .
drwxr-xr-x 3 root root 4096 2011-03-12 18:48 ..
drwxr-xr-x 3 root root 4096 2011-03-12 18:48 ..
drwx------ 2 root root 16384 2011-03-12 18:54 lost+found
root@...atros:/media# ls a2f202b6-a3ef-45b5-bce4-01c4d35af4a0/ -la
итого 28
drwxr-xr-x 4 root root 4096 2011-03-12 18:55 .
drwxr-xr-x 4 root root 4096 2011-03-12 19:08 ..
drwx------ 2 root root 16384 2011-03-12 18:54 lost+found
-rw-r--r-- 1 root root 3146 2011-03-12 19:07 lost+found/../../../etc/passwd
Guess what does "rm" with such filenames :-)
Another example of crafted fs is ext2 partition with EXT2_ERRORS_PANIC
option set in superblock and corrupted root directory. When run "ls" on
the fs, the kernel would panic.
While it was said that such attacks have low impact, some systems
already try to protect itself from untrusted external filesystems.
E.g. automounting of flash drives in Ubuntu is processed with
"-o nodev,nosuid". I read this as external flash drives are not fully
trusted and may contain some dangerous files. If some automatic file
processing of files on drives with specially crafted filenames is
started then it might have a security impact. I don't know such popular
apps, though.
What I suggest is something like "-o untrusted" option to mount. This
would mean that the system considers the input from such fs as a malicious
input. Such mounted fs would try to consider the data on disk as
untrusted and to be as robust as possible, e.g. check against
"/"-filenames, against corrupted fs structures, etc. I'd be happy to
hear opinions about the usefulness of this feature.
Thanks,
--
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
