CVE-2016-7032: High severity Todd Miller Sudo vulnerability

Florian Weimer of Red Hat reports:

the sudoers manual page says this:

EXEC and NOEXEC

If sudo has been compiled with noexec support and the underly‐ ing operating system supports it, the NOEXEC tag can be used to prevent a dynamically-linked executable from running further commands itself.

In the following example, user aaron may run /usr/bin/more and /usr/bin/vi but shell escapes will be disabled.

aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi

And:

To enable noexec for a command, use the NOEXEC tag as documented in the User Specification section above. Here is that example again:

aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi

This allows user aaron to run /usr/bin/more and /usr/bin/vi with noexec enabled. This will prevent those two commands from executing other commands (such as a shell). If you are unsure whether or not your system is capable of supporting noexec you can always just try it out and check whether shell escapes work when noexec is enabled.

However, the filtering DSO does not intercept all glibc functions which allow to spawn a shell. At least popen, system, and wordexp are missing:

Show quoted text 0000000000000c80 T execl 0000000000000cc0 T execl 0000000000000d00 T execl 0000000000000d40 T execle 0000000000000d80 T execle 0000000000000dc0 T execle 0000000000000e00 T execlp 0000000000000e40 T execlp 0000000000000e80 T execlp 0000000000000ec0 T exect 0000000000000f00 T exect 0000000000000f40 T exect 0000000000000f80 T execv 0000000000000fc0 T execv 0000000000001000 T execv 00000000000011c0 T execve 0000000000001200 T execve 0000000000001240 T execve 0000000000001040 T execvp 0000000000001080 T execvp 00000000000010c0 T execvp 0000000000001100 T execvP 0000000000001140 T execvP 0000000000001180 T execvP 0000000000001280 T execvpe 00000000000012c0 T execvpe 0000000000001300 T execvpe 0000000000001340 T fexecve 0000000000001380 T fexecve 00000000000013c0 T fexecve 0000000000001480 T posixspawn 0000000000001440 T posixspawn 0000000000001400 T posixspawn 0000000000001540 T posixspawnp 0000000000001500 T posixspawnp 00000000000014c0 T posixspawnp

The source file src/sudonoexec.c contains this comment:

/ Dummy versions of the execve() family of syscalls. We don't need to stub out all of them, just the ones that correspond to actual system calls (which varies by OS). Note that it is still possible to access the real syscalls via the syscall() interface but very few programs actually do that. /

This is wrong. Interposing execve does not override internal calls to execve within glibc.

The right fix is to set a seccomp filter which blocks execve in the DSO (after enabling PRSETNONEWPRIVS), rather than attempting to play catch-up with glibc.