Bug 460906 - (CVE-2008-3889) CVE-2008-3889 postfix: local DoS via leaked file descriptor
CVE-2008-3889 postfix: local DoS via leaked file descriptor
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
source=vendor-sec,reported=20080829,p...
: Security
Depends On: 459099 459100 459101
Blocks:
  Show dependency treegraph
 
Reported: 2008-09-02 11:26 EDT by Tomas Hoger
Modified: 2008-10-10 03:27 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-10-10 03:27:25 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2008-09-02 11:26:04 EDT
Wietse Venema reported an issue affecting Postfix 2.4+ on Linux systems with 2.6.x kernels.  Issue can be exploited by local user with privilege to run own programs from .forward or .procmailrc to cause denial of service.

Upstream advisory with further details:

Summary:
========
Postfix 2.4 and later, on Linux kernel 2.6, is vulnerable to a
denial of service attack by a local user. There is no breach of
data confidentiality or data integrity. This problem was found by
the Postfix author during routine source code maintenance.

Discussion:
===========
Postfix is an open-source mail transfer agent (MTA) that runs on
multiple types of UNIX systems.  Postfix 2.4 (released 2007)
introduces input/output event handling based on high-performance
primitives: BSD kqueue (also present in MacOS X), Linux epoll, and
Solaris /dev/poll.  These implement more scalable event handling
than the older select() and poll() primitives.

With 2.6 Linux kernels, Postfix 2.4 and later has an epoll file
descriptor leak when it executes non-Postfix commands in, for
example, a user's $HOME/.forward file.  A local user can access a
leaked epoll file descriptor to implement a denial of service attack
on Postfix. The attack may result in reduced Postfix performance,
or in automatic Postfix shutdown when an internal safety mechanism
triggers.  Some possible attacks are discussed in the last paragraph
of this section.

Not affected is Postfix input/output event handling based on BSD
kqueue and Solaris /dev/poll.  There, the kernel effectively revokes
access to the underlying kernel object when it creates a child
process with fork(), keeping the kernel object normally accessible
only by the process that creates it.

The above approaches could help to improve the consistency of Linux
input/output event notification.  Currently, 1) different Linux
processes may make conflicting updates to a shared epoll instance;
2) therefore, the Linux kernel may report input/output events to
processes that didn't ask for those events; and 3) those events may
involve activity on pipes, sockets, etc.  that aren't open in those
processes.  Such inconsistency could be avoided when an epoll
instance were normally accessible only by the process that creates
it.

Workaround:
===========
Allow only trusted users to control delivery to non-Postfix commands.
In the following example, the directory /var/forward is not writable
by users, and Postfix is configured to search for /var/forward/username
(plus optional address extension) instead of the default location
~~username/.forward (plus optional address extension).

/etc/postfix/main.cf:
    forward_path = /var/forward/${user}${recipient_delimiter}${extension},
	/var/forward/${user}

Other workarounds would be required for other mail filtering software
that executes commands in user-controlled configuration files.

Solution:
=========
Apply the source code patch below, or install an updated Postfix
version.  Postfix versions 2.4.9, 2.5.5, and 2.6-20080902 are made
available via http://www.postfix.org/. Vendors will make updated
versions available according to their own support policies.

Patch:
======

Begin of patch
*** src/util/events.c.orig	Mon Mar 24 13:19:23 2008
--- src/util/events.c	Tue Aug 26 17:43:41 2008
***************
*** 426,431 ****
--- 427,433 ----
  
  #define EVENT_REG_INIT_HANDLE(er, n) do { \
  	er = event_epollfd = epoll_create(n); \
+ 	if (event_epollfd >= 0) close_on_exec(event_epollfd, CLOSE_ON_EXEC); \
      } while (0)
  #define EVENT_REG_INIT_TEXT	"epoll_create"
  
End of patch
Comment 2 Tomas Hoger 2008-09-02 12:09:21 EDT
epoll support was only added in Postfix 2.4.  Therefore, this issue does not affect postfix versions as shipped with Red Hat Enterprise Linux 3, 4, and 5.
Comment 4 Fedora Update System 2008-10-09 17:31:17 EDT
postfix-2.5.5-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2008-10-09 17:33:11 EDT
postfix-2.5.5-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Red Hat Product Security 2008-10-10 03:27:25 EDT
This issue was addressed in:

Fedora:
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-8595
  https://admin.fedoraproject.org/updates/F9/FEDORA-2008-8593

Note You need to log in before you can comment on or make changes to this bug.