CVE-2013-4184: Insecure usage of /tmp/.UUID_STATE and /tmp/.UUID_NODEID #5

Open
diocles opened this Issue Jul 30, 2013 · 2 comments

Projects

None yet

2 participants

@diocles

This is a repost and update of https://rt.cpan.org/Public/Bug/Display.html?id=69277 - the bug tracker that CPAN points to appears to have changed at some point since 2011.

A symlink attack via Data::UUID is possible.

As user2:

ln -s /home/user1/test-file /tmp/.UUID_STATE

As user1:

perl -MData::UUID -e 'Data::UUID->new'

Then /home/user1/test-file is overwritten.

There are two points in UUID.xs which write to UUID_STATE_NV_STORE - both the DESTROY() and create() functions are affected.

On at least recent Debian kernels, it is necessary to disable symlink protection via "sysctl fs.protected_symlinks=0" to reproduce this issue.

A similar attack is possible via .UUID_NODEID, but only if combined with exploiting the race condition between fopen and fwrite, so this is much more difficult to reproduce.

@diocles

I have requested a CVE id from oss-security, and I will come back and update the report when one is assigned.

@rjbs
Owner

I really don't do anything on this library but apply patches. It's been without a dedicated maintainer almost since release. A patch for this issue would be appreciated.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment