Updated 2015-07-24 @ 12:33 UTC
It was discovered that the
libuser library contains two vulnerabilities which, in combination, allow unprivileged local users to gain root privileges.
libuser is a library that provides read and write access to files like
/etc/passwd, which constitute the system user and group database. On Red Hat Enterprise Linux it is a central system component.
What is being disclosed today?
Qualys reported two vulnerabilities:
- CVE-2015-3245: The
userhelperprogram allows local users to add linefeeds in the middle of records to
/etc/passwd, corrupting the file.
libuseruses a non-standard way of updating
/etc/passwdand related files. Its locking is incompatible with the rest of the system, and the files are rewritten in place, which means that the system may observe incorrect data.
It turns out that the CVE-2015-3246 vulnerability, by itself or in conjunction with CVE-2015-3245, can be exploited by an unprivileged local user to gain root privileges on an affected system. However, due to the way
libuser works, only users who have accounts already listed in
/etc/passwd can exploit this vulnerability, and the user needs to supply the account password as part of the attack. These requirements mean that exploitation by accounts listed only in LDAP (or some other NSS data source) or by system accounts without a valid password is not possible. Further analysis showed that the first vulnerability, CVE-2015-3245, is also due to a missing check in
libuser. Qualys has disclosed full technical details in their security advisory posted to the oss-security mailing list.
Which system components are affected by these vulnerabilities?
libuser is a library, which means that in order to exploit it, a program which employs it must be used. Ideally, such a program has the following properties:
- It uses
- It is SUID-root.
- It allows putting almost arbitrary content into
Without the third item, exploitation may still be possible, but it will be much more difficult. If the program is not SUID-root, a user will not have unlimited attempts to exploit the race condition. A survey of programs processing
/etc/passwd and related files presents this picture:
passwdis SUID-root, but it uses PAM to change the password, which has custom code to modify
/etc/passwdnot affected by the race condition. The account locking functionality in
libuser, but it is restricted to
util-linuxis SUID-root and uses
/etc/passwd(the latter depending on how
util-linuxwas compiled), but it has fairly strict filters controlling what users can put into these files.
lchshand related utilities from
libuserare not SUID-root.
chfn(in the util-linux package) have all three qualifications:
libuser-based, SUID-root, and lack of filters.
This is why
chfn are plausible targets for exploitation, and other programs such as
chsh are not.
How can these vulnerabilities be addressed?
System administrators can apply updates from your operating system vendor. Details of affected Red Hat products and security advisories are available on the knowledge base article on the Red Hat Customer Portal. This security update will change
libuser to apply additional checks to the values written to the user and group files (so that injecting newlines is no longer possible), and replaces the locking and file update code to follow the same procedures as the rest of the system. The first change is sufficient to prevent newline injection with
userhelper as well, which means that only
libuser needs to be updated. If software updates are not available or cannot be applied, it is possible to block access to the vulnerable functionality with a PAM configuration change. System administrators can edit the files
/etc/pam.d/chsh and block access to non-root users by using
pam_warn (for logging) and
#%PAM-1.0 auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth
This will prevent users from changing their login shells and their GECOS field.
userhelper identifies itself to PAM as “
chfn”, which means this change is effective for this program as well.
Red Hat would like to thank Qualys for reporting these vulnerabilities.
Update (2015-07-24): Clarified that
chfn is affected as well and linked to Qualys security advisory.