[CentOS] Serious attack vector on pkcheck ignored by Red Hat

[Warren Young]

On Feb 9, 2017, at 2:03 PM, Leonard den Ottolander <leonard at den.ottolander.nl> wrote:
> 
> On Thu, 2017-02-02 at 13:40 -0800, Gordon Messmer wrote:
>> Escalation *requires* attacking a program in a security context other 
>> than your own.
> 
> Not necessarily. Suppose the adversary is aware of a root
> exploit/privilege escalation in a random library.

There are two serious problems with this argument:

1.  Give me a scenario where this attacker can execute *only* pkcheck in order to exploit this hypothetical library’s flaw, but where the attacker cannot simply provide their own binary to do the same exploit.  Short of something insane like exposing pkcheck via CGI over HTTP, I don’t see how a flaw in pkcheck gives you something here that you don’t already have.

A vulnerable library is a vulnerable library.  Fix the library, don’t invent reasons to fix all the other programs on the system because the library is vulnerable.

2.  There’s no such thing as SUID libraries.  So, how is this hypothetical library of yours going to gain privileges that the executable linked to it does not have?  Point me at a CVE where a vulnerable library was used for privilege escalation.

You can point at vulnerable libraries giving data exfiltration and such all day long, but privilege escalation??