Received-SPF: pass (google.com: domain of oss-security-return-30193-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Message-ID: <ae09940c-6dc5-4de2-899a-0093cff4d6a0@gmail.com>
Date: Thu, 13 Jun 2024 09:12:02 +1000
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: oss-security@lists.openwall.com
References: <28902b9a-3255-4bfe-a3c8-d0e08fb5f426@redhat.com>
 <v4d8ln$2ut$1@ciao.gmane.io>
Content-Language: en-US
From: Matthew Fernandez <matthew.fernandez@gmail.com>
In-Reply-To: <v4d8ln$2ut$1@ciao.gmane.io>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [oss-security] Re: CVE-2024-35235 cups: Cupsd Listen arbitrary
 chmod 0140777


On 6/13/24 08:49, Tavis Ormandy wrote:
> On 2024-06-11, Zdenek Dohnal wrote:
>>   ???????? Impact
>>
>> Given that cupsd is often running as root, this can result in the change
>> of permission of any user or system files to be world writable.
>>
>>
>> https://github.com/OpenPrinting/cups/commit/a436956f3
>>
> 
> This is a pretty confusing description... if we accept the premise that an
> attacker can somehow get root to run cupsd with a modified configuration
> file (how???), then this patch doesn't seem sufficient. They can still
> get root to unlink() an arbitrary file, no?

Also with debug printing enabled `DEBUG_printf` does not 
save-and-restore `errno` and then does numerous things that can 
overwrite it. So presumably the `errno == ENOENT` branch is not reliable 
in this scenario.