*** This bug is a duplicate of bug 1839413 ***
https://bugs.launchpad.net/bugs/1839413
** Information type changed from Private Security to Public Security
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apport in Ubuntu.
https://bugs.launchpad.net/bugs/1839414
Title:
Apport follows symbolic links in path components when creating core
dump file
Status in Apport:
New
Status in apport package in Ubuntu:
New
Bug description:
Author: Sander Bos, <https://www.sbosnet.nl/>
Date: 2019-07-30
In data/apport, Apport (implicitly) protects against symbolic link
following for to be created core dump files, but not sufficiently:
181 core_path = os.path.join(cwd, 'core')
...
186 core_file = os.open(core_path, os.O_WRONLY | os.O_CREAT |
os.O_EXCL, 0o600)
When Apport opens (creates, actually) the core dump file in the
second line, symbolic link following is (implicitly) prevented due to
the combination of "os.O_CREAT" and "os.O_EXCL". However, this only
applies to the final path component of "core_path" (the core dump file
name of "core"), _not_ for the earlier path components (taken from
"cwd"). For those path components, no such prevention is explicitly
applied either. Thus, symbolic links in path components before "core"
are followed. Combined with a different issue of "cwd" being replaced
after reading out the current working directory but before using the "cwd"
variable's value, users may be able to replace any path component of the
"cwd" file system entry with a symbolic link pointing to an arbitrary
location on the file system.
This can for example be used to place core dumps in arbitrary (but
user-writable) directories different than the actual current working
directory of the crashed process, or even (user-writable) directories
outside the root directory in case of a chroot()ed crashed process or
outside of a container / sandbox in case of a containerized / sandboxed
process (because Apport is ran from the host's root file system, not
within such environment).
Proposed fix: make Apport not follow symbolic links in non-last path
components when writing core dump files.
To manage notifications about this bug go to:
https://bugs.launchpad.net/apport/+bug/1839414/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
