Bug 41433 - security: mudflap accepts environment variables if setuid
Summary: security: mudflap accepts environment variables if setuid
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: libmudflap (show other bugs)
Version: unknown
: P3 major
Target Milestone: ---
Assignee: Frank Ch. Eigler
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-09-22 11:21 UTC by Sebastian Krahmer
Modified: 2009-09-22 16:18 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2009-09-22 14:54:43

Attachments
proposed patch (719 bytes, patch)
2009-09-22 15:52 UTC, Frank Ch. Eigler 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2009-09-22 11:21:12 UTC 
mudflap accepts options via $MUDFLAP_OPTIONS even when running setuid.

-viol-gdb option invokes programs upon error detection which is bad.
Note that NULL ptr derefs which are unexploitable in userspace programs, then
become exploitable.
Fix by either ignoring this variable for setuid's (other options
are bad too; what worth a mudflap if it can be disabled for
setuids which it should protect) or some other magic.
Comment 1 Sebastian Krahmer 2009-09-22 11:33:29 UTC 
Changing system() to execve() is not enough since ressources
like open files may also leak from a setuid binary.
Comment 2 Frank Ch. Eigler 2009-09-22 15:52:06 UTC 
Created attachment 18631 [details]
proposed patch

This patch fixes and documents the can-of-wormsness of setuid.
Comment 3 Frank Ch. Eigler 2009-09-22 16:18:02 UTC 
Committed.
Comment 4 Frank Ch. Eigler 2009-09-22 16:18:03 UTC 
Subject: Bug 41433

Author: fche
Date: Tue Sep 22 16:17:50 2009
New Revision: 152026

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=152026
Log:
2009-09-22  Frank Ch. Eigler  <fche@redhat.com>

	PR libmudflap/41433
	* mf-runtime.c (__mf_init): Ignore $MUDFLAP_OPTIONS if
	running setuid or setgid.

Modified:
    trunk/libmudflap/ChangeLog
    trunk/libmudflap/mf-runtime.c