Vulnerability Report: Path traversal and Code Execution in dlopen via environment variable

[cldrn]

Vulnerability Report: Path traversal and Code Execution in dlopen via environment variable

Affected Project & Line:

mesa/src/glx/dri_common.c

Line 140 in 6cb9e99

if (geteuid() == getuid()) {

Summary

Applications using mesa may be vulnerable to attacks where a local attacker could execute arbitrary code through a maliciously crafted library, loaded via the dlopen() function. This could potentially lead to privilege escalation.

Details

The application reads unsanitized data from the environment variable. This tainted path is subsequently used directly by dlopen() without sufficient validation, allowing directory traversal and possibly loading external malicious libraries.

The security check currently implemented using [specific security check, e.g., geteuid() == getuid()] does not adequately protect against this vulnerability.

Reproduction Steps

1. Set the affected environment variable to a path containing a maliciously crafted library.
2. Run the application or initiate the specific function that calls dlopen().
3. Observe that the malicious code within the library gets executed.

Impact

Attackers with local access can load and execute arbitrary code in systems using the affected application. This can lead to data corruption, data theft, and potentially complete system compromise depending on the application's privileges.

Recommendation

• Implement thorough input validation for the paths loaded via the environment variables.
• Use a whitelist of allowed paths or directory names to mitigate the risk of arbitrary directory traversal.
• Drop elevated privileges immediately after they are no longer required.
• Regularly audit and review the code to ensure that all paths from which libraries or other external resources are loaded are properly validated.
• Check and compare the real group ID and the effective group ID with getgid() and getegid()

CVSS Score

High 7.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H]

Root Cause Analysis

The root cause of this vulnerability stems from the lack of input validation when reading paths from environment variables and the subsequent insecure use of such paths with the dlopen() function.

Additional References

https://docs.google.com/document/d/1lRE2lc00WAYa-427crBFO1yBzU7fSUmQIanh9W8Rglo/edit?usp=sharing