Symlink attack vulnerability in auto-saving

Symlink attack vulnerability in auto-saving

[Sven Joachim]

Following the recent discussion about symlinks and race-conditions in
the thread "creating backups in temporary directories", I may have
discovered a more severe vulnerability in auto-saving of files.  If a
file foobar exists, Emacs will write auto-save data to #foobar# and
follow symlinks.  That's rather bad if foobar is in a world-writable
directory. :-(


In GNU Emacs 22.1.50.1 (i486-pc-linux-gnu, GTK+ Version 2.10.13)
 of 2007-09-07 on debian, modified by Debian
 (Debian emacs-snapshot package, version 1:20070907-1)
Windowing system distributor `The X.Org Foundation', version 11.0.10300000
configured using `configure  '--build' 'i486-linux-gnu' '--host' 'i486-linux-gnu' '--prefix=/usr' '--sharedstatedir=/var/lib' '--libexecdir=/usr/lib' '--localstatedir=/var' '--infodir=/usr/share/info' '--mandir=/usr/share/man' '--with-pop=yes' '--enable-locallisppath=/etc/emacs-snapshot:/etc/emacs:/usr/local/share/emacs/22.1.50/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/22.1.50/site-lisp:/usr/share/emacs/site-lisp:/usr/share/emacs/22.1.50/leim' '--with-x=yes' '--with-x-toolkit=gtk' 'build_alias=i486-linux-gnu' 'host_alias=i486-linux-gnu' 'CFLAGS=-DDEBIAN -DSITELOAD_PURESIZE_EXTRA=5000 -g -O2''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: C
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: de_DE.UTF-8
  locale-coding-system: utf-8
  default-enable-multibyte-characters: t

Major mode: Help

Minor modes in effect:
  shell-dirtrack-mode: t
  display-time-mode: t
  auto-image-file-mode: t
  show-paren-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  auto-compression-mode: t
  temp-buffer-resize-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t
  view-mode: t

Recent input:
e SPC <return> M-x <up> <return> C-x d <return> g <up> 
<up> <up> <up> <up> <up> <up> <up> <up> <up> <return> 
C-x k <return> <f7> <down> <return> SPC a d f r e p 
ü ü ü ö ö ö ö l l l k k k <f7> <down> <return> g <return> 
C-x k <return> <f7> <down> <down> <down> <return> <down> 
<down> <down> <down> <down> <down> <down> <down> <down> 
<down> <down> <down> <down> <down> <down> <down> <down> 
<down> <down> <down> <down> <down> <down> <down> <prior> 
C-x 1 <up> <up> <up> <up> <up> <up> <up> <up> <up> 
<up> <up> <up> <up> <up> <up> <up> <up> <up> <up> <up> 
<up> <up> <up> <up> <up> <up> <up> <up> <up> <up> <up> 
<up> <up> <up> <up> <up> <up> <up> <up> <up> <up> <up> 
<up> <up> <up> <up> <up> <up> <up> <up> <up> <up> <up> 
<up> <up> <up> <up> <up> <down> <down> <down> <down> 
<down> <down> <down> <down> <down> <down> <down> <down> 
<down> <down> <down> <down> <down> <down> <down> <down> 
<down> <down> <down> <down> <down> <down> <down> <down> 
<down> <down> <down> <down> <down> <down> <down> <down> 
<up> <up> <down> <down> <down> <right> <right> <right> 
<right> <right> <right> <right> <right> <right> <right> 
<right> <right> <right> <right> <right> <right> <right> 
<left> <left> <right> <right> <right> <right> <right> 
<right> <right> <right> <right> <right> <right> <right> 
<right> <right> <right> <right> <right> <right> <right> 
<right> <right> <right> <right> <right> <right> <right> 
<right> <right> <right> <right> <down> <up> C-h C-g 
C-u h C-z C-u a C-z C-u C-h a a u t o - s a c <backspace> 
v e <return> C-x o <down> <down> <down> <down> <down> 
<down> <down> <down> <down> <down> <down> <down> <down> 
<down> <down> <down> <down> <return> C-x o M-x r e 
p o r t - e m a c s - b u g <return>

Recent messages:
Commands: d, s, x, u; f, o, 1, 2, m, v; ~, %; q to quit; ? for help. [2 times]
Undo! [2 times]
Loading apropos...done
Type C-x 1 to remove help window.  
Type C-x 4 o RET to restore the other window.  
Loading emacsbug...done
mouse-2, RET: find function's definition
uncompressing files.el.gz...done
Note: file is write protected
"/usr/share/emacs/22.1.50/lisp/#files.el.gz#" [2 times]

Re: Symlink attack vulnerability in auto-saving

[Davis Herring]

> Following the recent discussion about symlinks and race-conditions in
> the thread "creating backups in temporary directories", I may have
> discovered a more severe vulnerability in auto-saving of files.  If a
> file foobar exists, Emacs will write auto-save data to #foobar# and
> follow symlinks.  That's rather bad if foobar is in a world-writable
> directory. :-(

Just to put the message on all threads, in case it's deemed the correct
answer, O_EXCL can work here, too, with the same trick of renaming an old
(non-malicious) auto-save file to reduce the amount of time that no useful
auto-save data is on disk.

Davis

-- 
This product is sold by volume, not by mass.  If it appears too dense or
too sparse, it is because mass-energy conversion has occurred during
shipping.