[Bug hurd/34505] New: Hurd sutreuid/setregid does not appear to reset saved IDs

https://sourceware.org/bugzilla/show_bug.cgi?id=34505

            Bug ID: 34505
           Summary: Hurd sutreuid/setregid does not appear to reset saved
                    IDs
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: hurd
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
                CC: [email protected], tschwinge at sourceware dot org
  Target Milestone: ---
             Flags: security?

Red Hat Product Security has asked me to forward vulnerability reports
upstream.

The reports state that the setreuid/setregid code paths do not set the saved
IDs. I believe this is accurate. For example, setgid has this code.

      if (_hurd_id.gen.nuids > 0 && _hurd_id.gen.uids[0] == 0)
        {
          /* We are root; set the real and saved IDs too.  */
          _hurd_id.valid = 0;
          if (_hurd_id.aux.ngids < 2)
            {
              newaux = auxbuf;
              naux = 2;
            }
          newaux[0] = newaux[1] = gid;
        }

But this is missing from setregid. I'm not entirely sure how __auth_makeauth is
implemented under the hood, so it could still implicitly remove save IDs.  But
I think this removal should still happen for setreuid (getuid (), -1), and I
can't quite see how this can happen with the current code.

I've been instructed to mention this: Found by AISLE in partnership with Red
Hat. (Although reports were split between setreuid and setregid, which wasn't
useful.)

-- 
You are receiving this mail because:
You are on the CC list for the bug.