OpenBSD allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root.
Tag: OpenBSD
ASA-2019-00653 – OpenBSD: Local privilege escalation via S/Key and YubiKey
OpenBSD, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root.
ASA-2019-00652 – OpenBSD: libc’s authentication layer performed insufficient username validation
libc in OpenBSD allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c and gen/authenticate.c in libc (and login/login.c and xenocara/app/xenodm/greeter/verify.c).
ASA-2019-00651 – OpenBSD: Local privilege escalation via xlock
xlock in OpenBSD allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen.
ASA-2019-00650 – OpenBSD: Local privilege escalation via su
A local attacker can exploit su's -L option ("Loop until a correct username and password combination is entered") to log in as themselves but with another user's login class (with the exception of root's login class if the attacker is not in the group "wheel"), because the class variable is set once and never reset.
ASA-2019-00160 – OpenBSD: GDT and IDT limits were improperly restored during VMM context switches
GDT and IDT limits were improperly restored during VMM context switches.
ASA-2019-00159 – OpenBSD: States in pf (packet filter) let ICMP and ICMP6 packets pass
States in pf (packet filter) let ICMP and ICMP6 packets pass if they have a packet in their payload that matches an exiting connection. It was not checked whether the outer ICMP packet has the same destination IP as the source IP of the inner protocol packet.
ASA-2019-00116 – OpenBSD: IPv6 fragmentation vulnerability in OpenBSD Packet Filter
Unless IPv6 reassembly is explicitly disabled, Packet Filter reassembles IPv6 fragments to perform the filtering based on its configuration. The packets are then re-fragmented to comply with the end-to-end nature of the IPv6 fragmentation. When dealing with malicious fragmented IPv6 packets, the functions pf_reassemble6() and pf_refragment6(), may use an improper offset to apply a transformation on the packets. This behavior can have the following impacts: A kernel panic can happen, effectively stopping the system; An unexpected modification of the packets before and after the application of the filtering rules can occur. This may be leveraged to bypass the rules under some circumstances (see Rule bypass p.10). Note that with a GENERIC kernel, the panic drops to the debugger and does not reboot without a manual intervention.