CVE-2007-5159: Medium severity red hat fedora vulnerability

Description of problem: Fuse in general and Fedora's way to let only members of the group fuse access and use fuse was discussed in https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00163.html and mails below in that thread.

There we noticed that members of the group fuse can get access to devices which they normally should not have access to. See https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00163.html ; the relevant parts of it:

$ ls -l /dev/sda3 brw-r----- 1 root disk 8, 3 14. Sep 16:10 /dev/sda3 $ groups thl fuse $ dd if=/dev/sda3 bs=512K count=1 | strings dd: opening /dev/sda3': Permission denied $ mkdir ntfs $ /sbin/mount.ntfs-3g /dev/sda3 ntfs/ $ touch ntfs/foo $ ls -l ntfs/foo -rwxrwxrwx 1 thl thl 0 18. Sep 19:27 ntfs/foo

ntfs-3g IMHO should fail, as the users should not get access to random devices he has no access to. Quoting Alexander Larsson from https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00171.html

Thats quite weird. The way I undestand fuse is that you run the filesystem as your user, and then that filesystem (via libfuse) spawns fusermount to open the fuse device and attach to the mountpoint. fusermount then passes the fd to the fuse device back the the filesystem process (via a socket) which then handles all the requests. Reading the data source for the filesystem (if there is any) is only done by the filesystem process, not by the setuid fusermount helper, so it should not be able to read /dev/sda3.

Further investigation showed that ntfs-3g gets installed SUID root:

$ ls -l /sbin/mount.ntfs-3g -rwsr-xr-- 1 root fuse 40528 17. Sep 23:14 /sbin/mount.ntfs-3g

That might be wrong as that afaics makes it possible for ntfs-3g to access devices which the user normally would not have access to. Quoting Alexander again, this time from https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00174.html

Oh. That seems like a bad idea to me. If this drops privs after opening the device I think you can attach to the process using e.g. gdb and call any read() operation on the device. If might even mean (with some creative exploits) that any fuse group user can read any block on any disk.

Version-Release number of selected component (if applicable): ntfs-3g-1.913-1.fc8

Please note that I as ex-maintainer of fuse stumbled into this by accident -- I don't care much about fuse and ntfs-3g these days, but I think the behavior of ntfs-3g is a security bug.