CVE-2015-3315: Race Condition

The following flaws were reported by Tavis Oramandy:

Furthermore, Abrt suffers from numerous race conditions and symlink problems from trusting unprivileged programs. For example, the code below (and lots of similar code) is vulnerable to a filesystem race where a user unlinks the file after the copy but before the chown. https://github.com/abrt/abrt/blob/master/src/hooks/abrt-hook-ccpp.c#L634

strcpy(sourcefilename + sourcebaseofs, "maps"); strcpy(destbase, FILENAMEMAPS); copyfile(sourcefilename, destfilename, DEFAULTDUMPDIRMODE); IGNORERESULT(chown(destfilename, dd->dduid, dd->ddgid));

This code trusts various symlinks in /tmp without validation:

https://github.com/abrt/abrt/blob/master/src/hooks/abrt-hook-ccpp.c#L806

char javalog = xasprintf("/tmp/jvm-%lu/hserror.log", (long)pid); int srcfd = open(javalog, ORDONLY); free(javalog);

This code trusts the /proc/pid/exe symlink, even though it is possible to link it anywhere you want.

https://github.com/abrt/abrt/blob/master/src/hooks/abrt-hook-ccpp.c#L368

sprintf(buf, "/proc/%lu/exe", (long)pid); int srcfdbinary = open(buf, ORDONLY); / might fail and return -1, it's ok /

This code trusts the attacker controlled root symlink and copies files from it.

https://github.com/abrt/libreport/blob/master/src/lib/dumpdir.c#L671

if (chrootdir) copyfilefromchroot(dd, FILENAMEOSINFOINROOTDIR, chrootdir, "/etc/os-release");

This instructs librpm to trust an unprivileged root symlink:

https://github.com/abrt/abrt/blob/master/src/daemon/rpm.c#L184

if (rpmtsSetRootDir(ts, rootdirorNULL) != 0) { rpmtsFree(ts); return -1; }

And so on.

There are other automatic crash analysis scripts, I believe systemd also has one - I haven't looked at it all.

Mitigation:

It is recommended to disable abrt via the following command line, till the flaws have been resolved: sysctl -w kern.corepattern=core

Note: This will reset, if abrt is re-started.

— Red Hat