Pam 1.5.0 has a auth bypass under some conditions

https://www.openwall.com/lists/oss-security/2020/11/24/3

by 0x0 • 6 years ago

44 23 6 years ago

openwall.com

EE84M3i2• 6 years ago

looking at the fixing commit[1]... does libpam not have unit tests..?

[1] https://github.com/linux-pam/linux-pam/commit/af0faf666c5008...

saghm• 6 years ago

Does that actually fix it? The linked email listing says the issue is that logging in as a non-existent user with an empty password will work, and the fix that you linked seems to just make it harder to figure out if a user doesn't exist. That doesn't seem like it fixes anything; there's no need to determine beforehand if a user doesn't exist to use this exploit, since you could just try to use the exploit with an arbitrary username, and if it works, then obviously the user doesn't exist.

kevinoid• 6 years ago

I agree. I think the GP commit introduced the bug and the fixing commit was https://github.com/linux-pam/linux-pam/commit/30fdfb90d9864b...

AceJohnny22• 6 years ago

I hate to be that guy, but _damn_ does PAM seem ripe for being rewritten in Rust. Maybe it's the PTSD speaking, but seeing vanilla C string operations in a security-critical library makes my hair stand on end.

Searching around, the best I can find is one 0.1 crate that hasn't seen activity since 2017:

https://crates.io/crates/librustpam

Foxboron• 6 years ago

Nothing about this CVE was related to the language though. It's a configuration issue along with nullok.

yencabulator• 6 years ago

Please, instead, let's have something that isn't a shared library loaded into everything. Something usable by contained/isolated/sandboxed software just by giving them a unix domain socket to talk to, with no need to share /etc/shadow.

edgyquant• 6 years ago

You should definitely write an MVP and come back with one. Or write a blog post explaining what parts would benefit and why it is a clear cut case for a rewrite and then post it here.

saagarjha• 6 years ago

I wonder if I should create a "pam_unix_non_existent:" account.

icedchai• 6 years ago

Can you actually do that? ":" is the separator in the password file.

cpach• 6 years ago

Sorry to be blunt but isn’t it best to avoid PAM these days?

kelnos• 6 years ago

Doesn't pretty much every mainstream Linux distro use it?

sleepydog• 6 years ago

What is an alternative? PAM seems pretty ubiquitous.

AceJohnny22• 6 years ago

built-in auth in whatever program.

It's saying something that rolling-your-own is even a debatable alternative to PAM (because if there's a flaw in your program, "only" that program is vulnerable, not the whole system. "Only" in quotes because it's just one privilege escalation step away)

Fnoord• 6 years ago

FWIW, OpenBSD doesn't use PAM; it has been using BSD_Auth [1] since forever.

The other BSDs and macOS use OpenPAM [2] instead of Linux PAM. Both are written in C.

[1] https://en.wikipedia.org/wiki/BSD_Authentication

[2] https://en.wikipedia.org/wiki/OpenPAM

amerine• 6 years ago

Do you mean via mod_pam style PAM module creations? Help Me understand what you mean.

pepemon• 6 years ago

PAM is an authn core in any modern mainstream Linux distro. If you build and/or tweak Linux boxes, PAM was almost always here right with you. The only question is do you know what exacly PAM do?

jsiepkes• 6 years ago

I remember when I was in school (about 15 years ago) Slackware was one of the few distro's that didn't have PAM and they made a big point of it. So I did a quick Google just now and found that this year (2020) even Slackware got PAM [1]. Had a good chuckle over that.

[1] https://alien.slackbook.org/blog/slackware-introduces-pam-in...

pengaru• 6 years ago

Unrelated to the auth bypass, but on the topic of linux-pam; this summer I landed exposing prctl(PR_SET_NO_NEW_PRIVS) in pam_limits [0]. It's a convenient way to prevent logins from potentially attaining new privileges, even if bad actors find bugs in suid programs or even know the root password (assuming remote root logins are disabled).

[0] https://github.com/linux-pam/linux-pam/commit/dd9cf929e7ec79...

cyphar• 6 years ago

I would love to see no_new_privs more widely used, so thanks!

Unfortunately it should be noted on most distributions this will cause counterintuitive breakages -- most notably ping won't work for unprivileged users (but luckily you can fix this by changing net.ipv4.ping_group_range to include the unprivileged user groups -- I hope distributions fix this eventually...).

Pam 1.5.0 has a auth bypass under some conditions

Related Stories