From: Don Howard <dhoward@redhat.com>
Subject: [RHEL 5.1 patch] CVE-2007-0958 core dump of read-only binarys 
Date: Wed, 21 Feb 2007 11:35:06 -0800 (PST)
Bugzilla: 228886
Message-Id: <Pine.LNX.4.64.0702210632210.5706@sugarmagnolia.remotee.org>
Changelog: [fs] core dump of read-only binarys {CVE-2007-0958}



BZ 228886: CVE-2007-0958 core-dumping unreadable binaries via PT_INTERP

>From http://www.isec.pl/vulnerabilities/isec-0017-binfmt_elf.txt:

	"An user may create a manipulated ELF binary that requests a 
	 non-readable but executable file as program interpreter and gain 
	 read access to the privileged binary.  This works only if the 
	 file is a valid ELF image file, so it is not possible to read a 
	 data file that has the execute bit set but the read bit cleared. 
	 A common usage would be to read exec-only setuid binaries to gain 
	 offsets for further exploitation."

The upstream patch adds a test for MAY_READ permission for the 
interpreter.

commit 1fb844961818ce94e782acf6a96b92dc2303553b
Author: Alexey Dobriyan <adobriyan@openvz.org>

    [PATCH] core-dumping unreadable binaries via PT_INTERP
    
    Proposed patch to fix #5 in
    http://www.isec.pl/vulnerabilities/isec-0017-binfmt_elf.txt
    aka
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1073
    
    To reproduce, do
    * grab poc at the end of advisory.
    * add line "eph.p_memsz = 4096;" after "eph.p_filesz = 4096;"
      where first "4096" is something equal to or greater than 4096.
    * ./poc /usr/bin/sudo && ls -l
    
    Here I get with 2.6.20-rc5:
    
     -rw------- 1 ad   ad   102400 2007-01-15 19:17 core
     ---s--x--x 2 root root 101820 2007-01-15 19:15 /usr/bin/sudo
    
    Check for MAY_READ like binfmt_misc.c does.
    
    Signed-off-by: Alexey Dobriyan <adobriyan@openvz.org>
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 90461f4..669dbe5 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -682,6 +682,15 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 			retval = PTR_ERR(interpreter);
 			if (IS_ERR(interpreter))
 				goto out_free_interp;
+
+			/*
+			 * If the binary is not readable then enforce
+			 * mm->dumpable = 0 regardless of the interpreter's
+			 * permissions.
+			 */
+			if (file_permission(interpreter, MAY_READ) < 0)
+				bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
+
 			retval = kernel_read(interpreter, 0, bprm->buf,
 					     BINPRM_BUF_SIZE);
 			if (retval != BINPRM_BUF_SIZE) {
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 6e6d456..a4d933a 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -234,6 +234,14 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
 				goto error;
 			}
 
+			/*
+			 * If the binary is not readable then enforce
+			 * mm->dumpable = 0 regardless of the interpreter's
+			 * permissions.
+			 */
+			if (file_permission(interpreter, MAY_READ) < 0)
+				bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
+
 			retval = kernel_read(interpreter, 0, bprm->buf,
 					     BINPRM_BUF_SIZE);
 			if (retval < 0)