Bug 339338 – <net-dialup/mingetty-1.08-r1: unsafe chroot() call

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Matthias Maier 2010-10-01 10:29:35 UTC]

Stealing from the Debian-bugtracker: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=597382

""
mingetty doesn't change current directory after chroot() call.
It allows an attacker to call chdir("../") many times and get root directory.
Also chdir(), chroot() and nice() are not checked for error return values.
It allows an attacker to avoid local policy restriction in some cases.
""

A quick peek into the source-code for the two stable ebuilds in the portage tree confirms that they are also affected.

Please not also the additional security-fix in message 10 in the Debian-bugreport:

""
Changes: 
 mingetty (1.07-2) unstable; urgency=high
 .
   * Critical security patch: Fix unsafe chroot call. (Closes: #597382)
   * Checked dependencies for locusts. (Closes: http://xkcd.com/797/)
""


Reproducible: Always

[Comment 1 Matthias Maier 2010-10-01 10:30:16 UTC]

Created attachment 249166 [details, diff]
The proposed patch on the Debian-bugtracker

[Comment 2 Alex Legler (RETIRED) 2010-10-01 11:09:43 UTC]

(In reply to comment #0)
> 
> A quick peek into the source-code for the two stable ebuilds in the portage
> tree confirms that they are also affected.
> 

net-dialup: Can you get in touch with upstream and confirm the proposed patch please?

> Please not also the additional security-fix in message 10 in the
> Debian-bugreport:
> 
> ""
> Changes: 
>  mingetty (1.07-2) unstable; urgency=high
>  .
>    * Critical security patch: Fix unsafe chroot call. (Closes: #597382)
>    * Checked dependencies for locusts. (Closes: http://xkcd.com/797/)
> ""

Only Debian-based distributions are susceptible to this kind of attack. Gentoo is not vulnerable to locusts, only to flattery as per http://xkcd.com/424/. The Gentoo Security Team still advises to emerge app-admin/insecticide and apply when needed.</joking>

[Comment 3 Chris Reffett (RETIRED) 2013-09-03 04:30:28 UTC]

@maintainers: if you haven't heard from upstream, could we get that patch applied please? (/check if it's incorporated into 1.08)

[Comment 4 Aaron Bauman (RETIRED) 2016-02-29 14:00:12 UTC]

@maintainers, still no patched applied.

[Comment 5 Lars Wendler (Polynomial-C) (RETIRED) 2016-02-29 16:10:25 UTC]

commit b7f5ecdb823d96112c5e86a128c833a0c1aa1788
Author: Lars Wendler <[e-mail]>
Date:   Mon Feb 29 17:08:08 2016

    net-dialup/mingetty: Fixed usage of unsafe chroot call (bug #339338).
    
    Package-Manager: portage-2.2.27
    Signed-off-by: Lars Wendler <[e-mail]>

 .../mingetty-1.08-check_chroot_chdir_nice.patch    | 36 ++++++++++++++++++++++
 net-dialup/mingetty/mingetty-1.08-r1.ebuild        | 34 ++++++++++++++++++++
 2 files changed, 70 insertions(+)

[Comment 6 Aaron Bauman (RETIRED) 2016-03-21 12:33:04 UTC]

@arches, please stabilize on the following:

TARGET KEYWORDS = alpha, amd64, arm, hppa, ia64, ppc, ppc64, s390, sparc, x86

[Comment 7 Agostino Sarubbo 2016-03-22 14:34:10 UTC]

amd64 stable

[Comment 8 Jeroen Roovers (RETIRED) 2016-03-26 09:25:08 UTC]

Stable for HPPA PPC64.

[Comment 9 Agostino Sarubbo 2016-03-27 10:16:19 UTC]

ppc stable

[Comment 10 Markus Meier 2016-03-30 18:27:52 UTC]

arm stable

[Comment 11 Agostino Sarubbo 2016-04-11 10:40:36 UTC]

x86 stable

[Comment 12 Tobias Klausmann (RETIRED) 2016-05-20 11:28:00 UTC]

Stable on alpha.

[Comment 13 Aaron Bauman (RETIRED) 2016-06-06 11:55:30 UTC]

@arches, please finish stabilization so we can move on to cleanup.  Thanks.

[Comment 14 Agostino Sarubbo 2016-07-08 10:02:45 UTC]

sparc stable

[Comment 15 Agostino Sarubbo 2016-07-08 12:03:04 UTC]

ia64 stable.

Maintainer(s), please cleanup.

[Comment 16 Aaron Bauman (RETIRED) 2016-07-09 02:36:17 UTC]

Removing unstable arch.  

GLSA Vote: No

@maintainer(s), please cleanup the vulnerable ebuild.

[Comment 17 Aaron Bauman (RETIRED) 2016-07-09 13:11:07 UTC]

Cleaned:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=92acc2e7a22c8aa53f7d650ea54fb79d69ff7c07