illumos gate

CVE-2020-2771

From [[https://github.com/0xdea/advisories/blob/master/2020-07-solaris-whodo-w.txt]]:

raptor@stalker:~$ id
uid=100(raptor) gid=10(staff)
raptor@stalker:~$ cp /usr/bin/sleep AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
raptor@stalker:~$ exec -a '- BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB' ./AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 256 &
[switch to another shell]
raptor@stalker:~$ whodo -l # or w
 12:43pm  up 5 day(s), 20 hr(s), 36 min(s)  5 user(s)
User     tty           login@  idle   JCPU   PCPU  what
raptor   vt/7         Tue 2pm 6days   1:49   1:49  /usr/lib/tracker-miner-apps
Segmentation Fault

• The psinfo structure info is populated by reading /proc/<pid>/psinfo
• The char array info.pr_fname¹⁶ is copied into the char array
  up->p_comm[80+1]
• As a side note, the call to strncpy() at lines 344-345 incorrectly uses the
  size of the source buffer instead of the size of the destination buffer, but
  in this case this programming mistake doesn't cause a problem, because the
  source buffer is always smaller than the destination buffer:
  (void) strncpy(up->p_comm, info.pr_fname,
  sizeof (info.pr_fname));
• The char array up->p_args[80+1] is then populated at line 418 based on the
  char array info.pr_psargs⁸⁰ as follows:
  (void) strcpy(up->p_args, info.pr_psargs);
• If up->p_args begins with "?" or "- " (or, more correctly, with "-" followed
  by any byte <= 0x20), the following code branch at lines 423-425 is taken:
  (void) strcat(up->p_args, " (");
  (void) strcat(up->p_args, up->p_comm);
  (void) strcat(up->p_args, ")");
• In detail, the following chars are appended to the string:
  " (" + up->p_comm [maximum size excluding NULL-terminator is 15] + ")" + NULL
• Therefore, it is possible to overflow the up->p_args buffer at most as
  follows: * Buffer is 81 bytes: "- " + "B"x77 + " (" * Overflow is 17 bytes: "A"x15 + ")" + NULL

As noted in the original disclosure, the bug does not appear to be currently exploitable (however there's no guarantee that can't change in the future). We should fix the overflow and proactively further harden w and whodat.