RedHat 4.1 amd-920824upl102-6.i386.rpm nodev hole.

Date: Mon, 7 Apr 1997 22:59:27 -0400 (EDT)
From: Bradley M Keryan 
Reply-To: linux-security@redhat.com
To: linux-security@redhat.com
Subject: [linux-security] amd 920824upl102 ignores the nodev option
Resent-Date: 8 Apr 1997 08:38:45 -0000
Resent-From: linux-security@redhat.com
Resent-cc: "recipient.list.not.shown":;

amd from the amd-920824upl102-6.i386.rpm file distributed with RedHat
Linux 4.1 does not honor the nodev option for NFS filesystems and probably
other mount types, allowing any user access to the device files in /dev on
a system, provided that they have root access to another linux box on the
network. In addition, the default amd.conf from RH 4.1 maps /net/* to NFS
mounting, which makes the bug in amd an easily accessible security hole.

The Exploit:

A friend of mine who has an account on my machine found a major security
hole in amd when he decided to play a prank on me involving /dev/dsp at
odd hours, but found I had denied access to /dev/dsp and /dev/audio. He
assumed that I had forgotten to put the options nosuid and nodev in the
amd mapping for NFS (the default RedHat 4.1 mapping, which *does* have
opts=nosuid,nodev), so he created a char device on his machine with major
number 14 and minor 3, permissions 666, exported the directory it was in
via NFS, and logged into my machine. He used the /net/* amd mapping to
mount the directory, and then used the char device in the NFS-mounted
filesystem to play sounds, although /proc/mounts and /etc/mtab displayed
it as mounted nodev.

This exploit works for block and char devices. It could be used to do more
malicious acts than merely play sounds, such as scan /dev/mem for
passwords, change file permissions or the contents of /etc/shadow with a
raw disk editor, and sundry and various other bad things.

This bug may affect any other distributions that include amd, but both
the exploit and the bug have only been tested on RedHat 4.1.

The Fix:
A one-character typo in the linux-specific header file for amd prevents it
from actually passing the nodev option to the kernel.


--- amd-upl102/config/os-linux.h.bad    Mon Apr  7 16:41:51 1997
+++ amd-upl102/config/os-linux.h        Mon Apr  7 16:42:19 1997
@@ -252,7 +252,7 @@
 
 #define M_RDONLY 1 /* mount read-only */
 #define M_NOSUID 2 /* ignore suid and sgid bits */
-#define M_NONDEV 4 /* disallow access to device special files */
+#define M_NODEV 4 /* disallow access to device special files */
 #define M_NOEXEC 8 /* disallow program execution */
 #define M_SYNC  16 /* writes are synced at once */
 #define M_REMOUNT  32 /* alter flags of a mounted FS */


That's it. Evidently M_NODEV was defined to something else elsewhere,
otherwise amd shouldn't have compiled.

Brad Keryan
keryan@andrew.cmu.edu
http://fatale.res.cmu.edu/