Setgid/Setuid binary writing privilege escalation

[halfdog <me () halfdog net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello List,

As first shown in [0] for escalation from user "man:man" to "man:root"
and later to "root:root", the issue was assigned low priority. Setgid
directories are rare, user "man" is rarely used, so escalation risk is
not so high. Apart from that, it was unclear, what would be correct
behavior regarding POSIX.

Later on in [1], using the very same method with overlayfs was
suitable to escalate from any user to root.

After looking at that more closely, I found today another method to
escalate e.g. on Ubuntu Trusty/Wily to any group to be found with
"find / -perm -02020", this is e.g. staff, mail, libuuid. As staff is
has rwx permissions on python dist-packages and /var/local, any root
process accessing those is at high risk to be used to escalate to uid
root also.

Hence it seems, that the problem [0] increases the attack surface in
general. Should it therefore be treated as a security vulnerability
and assigned a CVE?

[0]
http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/
[1]
http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlaacjYACgkQxFmThv7tq+6wDQCffUVFOpFxKUa+TfUQrJ+0WpLy
FnwAn3FN/wVZIZiqZABh6obBTaat1VCb
=Q9HM
-----END PGP SIGNATURE-----