Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 602492

Summary: sys-devel/icecream: root privilege escalation
Product: Gentoo Security Reporter: Michael Orlitzky <mjo>
Component: AuditingAssignee: Gentoo Security <security>
Status: IN_PROGRESS ---    
Severity: major CC: ajak, alexxy, bicatali, bircoph, cluster, jsbronder, jstein, lucas.yamanishi, mgorny, miska, mschiff, o.freyermuth, pchrist, prometheanfire, sam, scarabeus, security-audit, ultrabug, xarthisius
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
See Also:
Whiteboard: B1 [ebuild]
Package list:
Runtime testing required: ---

Description Michael Orlitzky gentoo-dev 2016-12-13 02:59:30 UTC
The init script for sys-devel/icecream does...

  [[ ! -d /var/log/icecream/ ]] && \
    mkdir -p /var/log/icecream/ && \
    chown icecream:icecream /var/log/icecream/

after which the /var/log/icecream directory is owned by its user. Then, it does

  local slogfile=${ICECREAM_SCHEDULER_LOG_FILE:-"/var/log/icecc_scheduler"}
  touch ${slogfile} && chown icecream:icecream ${slogfile}

Now, the shell default value there is safe, but the conf.d file that we install has


which is under the directory owned by icecream:icecream. To gain root, the icecream user can replace that log file by a symlink to something important (this works because he owns the directory that contains it). The next time the icecream service is started, that important thing will get chowned to icecream:icecream.

p.s. the init script should be POSIX shell, not bash =)
Comment 1 Michael Orlitzky gentoo-dev 2016-12-13 18:17:32 UTC
As we discovered over in bug #602550, users of vanilla-sources (and others) are vulnerable to the same attack using hard links, so simply adding "--no-dereference" to the "chown" call is not enough to fix this.
Comment 2 Michael Orlitzky gentoo-dev 2017-09-30 19:45:31 UTC
I think 9 months is a fair embargo period, can this please be made public so that I can reference it in a CVE request?
Comment 3 Michael Orlitzky gentoo-dev 2018-03-10 22:09:08 UTC
Ping? =o
Comment 4 Michael Orlitzky gentoo-dev 2019-09-14 16:37:08 UTC
Nobody's home, CCing mgorny for treeclean.
Comment 5 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2020-04-03 23:16:17 UTC
Unrestricting and reassigning to security@ per bug #705894
Comment 6 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2020-04-03 23:18:00 UTC
unrestricting per bug 705894
Comment 7 Lucas Yamanishi 2020-05-26 18:04:43 UTC
Fix submitted here:
Comment 8 Michael Orlitzky gentoo-dev 2020-05-26 18:23:24 UTC
(In reply to Lucas Yamanishi from comment #7)
> Fix submitted here:

Sadly this just trades one root exploit for another, because there's a 2.5-year-old root exploit in our default init system that affects your tmpfiles "Z" entry:

That's never going to get fixed under the current management, so you should find a way to avoid "Z" entries (and nested "d" or "f" entries) if possible.
Comment 9 Lucas Yamanishi 2020-05-26 20:34:23 UTC
Ah, I copied that file from SuSE without looking at it.  It seems most of these were introduced there.  I've pushed a change to fix it using "d" with an age field.