Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution

[Solar Designer <solar () openwall com>]

On Sun, Apr 16, 2023 at 06:12:18PM +0800, Ruihan Li wrote:
> The exploitation works as long as there are setuid programs (or more
> precisely, programs with the CAP_NET_ADMIN capability) that invokes ioctl
> calls on stdin, stdout, or stderr. In most Linux distros, a quick (but very
> coarse) test reveals that quite a few setuid programs are using ioctl system
> calls, which are marked with 'V' in the table below:
> ```
> # find . -user root -perm -4000 -exec sh -c "strace -e trace=ioctl {} < /dev/null 2>&1 > /dev/null | grep ioctl > 
> /dev/null && echo -n 'V ' || echo -n 'S '; echo {};" \; | sort
> S ./chage
> S ./expiry
> S ./fusermount
> S ./fusermount3
> S ./gpasswd
> S ./ksu
> S ./mount.cifs
> S ./sg
> S ./umount
> V ./chfn
> V ./chsh
> V ./mount
> V ./newgrp
> V ./passwd
> V ./pkexec
> V ./screen-4.9.0
> V ./su
> V ./sudo
> V ./unix_chkpwd
> ```
> After manually checking the strace output, it is found that all of these ioctl
> users are using ioctl calls on stdin, stdout, or stderr to get or set some tty
> parameters. Note that exactly no arguments are passed to these setuid
> programs. If some crafted arguments are passed, the number of ioctl users may
> increase. As a result, a number of linux distros can be vulnerable to the
> exploitation.

BTW, even with the kernel bug fixed, there are ioctl number clashes
between different devices, so even e.g. isatty(3) is not necessarily
safe if called with elevated privileges under a possible confused deputy
scenario.  Here's strace showing some clashes on older Linux/i386:

$ cat isatty.c
int main(void) { return isatty(0); }
$ gcc isatty.c -o isatty
$ strace -e ioctl ./isatty
ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0

IIRC, I was the one to add this feature to strace 20+ years ago:

* Sat Jun 08 2002 Solar Designer <solar-at-owl.openwall.com>
- Updated to today's CVS version (post-4.4) with an additional fix for
displaying all possible ioctl names when there's more than one match,

So the number clashes were known, but the security relevance maybe not.

Alexander