19

I am learning about linux security and struggling to understand why a USB stick with a character device on it is potentially dangerous.

If I have a USB stick with a bash executable that has setuid root on it, the danger is obvious: Anybody with such a USB stick can gain root privileges on my computer if I have an entry like

/dev/sdb1 /media/usbstick auto defaults 0 0

in my /etc/fstab because defaults includes suid.

But what about character devices? How can I use a character device to gain root privileges or break stuff if a USB stick with a character device on it gets mounted with dev or defaults?

31

Because access to the underlying device is controlled only by file permissions by default, so if your USB stick contains a POSIX filesystem with a world-writable device node corresponding to a real device in the system, you can use that device node to access the corresponding device as a "plain" user. Imagine a device corresponding to one of the audio devices, your webcam, /dev/sda (which is a block device rather than a character device, but the argument is the same)...

Here's an example to make things clearer. Say you want to access /dev/sda (then you can pretty much do anything you want with the contents of the disk, including planting a program which would allow you to become root; this is a block device but the problem is the same with character devices). On your target system, ls -l /dev/sda shows

brw-rw----  1 root disk      8,   0 Sep  8 11:25 sda

This means /dev/sda is a block device (the b at the beginning of the line), with major number 8 and minor number 0 (the 8, 0 in the middle of the line). The device is only accessible to root (read/write) and members of the disk group (also read/write).

Now imagine on this system you can't become root but for some reason you can mount USB sticks as a user without nodev. On another system, where you are root, you can create a corresponding special file on your USB key:

mknod -m 666 usersda b 8 0

This will create a special file called usersda, readable and writable by everyone.

Mount the key on your target system and hey presto, you can use the usersda device in the same way as /dev/sda, but with no access restriction...

(This will work even with encrypted file systems, as long as you are able to access the decrypted mapper device: create device which matches the appropriate /dev/mapper entry.)

  • That sounds interesting! But I'm not sure I understand it. A device is a file and files are accessed through inodes. The fake device on my USB stick would have a different inode and therefore it would be a different device, wouldn't it? – rosix Mar 6 '15 at 17:02
  • 7
    A device is a special file, with a major and minor number; you can see those if you do ls -l /dev, they're the two numbers which appear instead of the file size. The kernel matches a device special file with a driver using those numbers, so you can have multiple files which point to the same kernel driver and device. The special files are created using mknod. – Stephen Kitt Mar 6 '15 at 17:05
  • Note that /dev/tty* devices are character devices, and an intruder gaining full read/write access to your terminal sessions and/or the system console combined with abusing terminal emulator features might allow all kinds of nasty tricks... – telcoM Jan 25 at 14:52
  • 1
    @TheQuark pretty much, yes. It’s a little more general; I’d say “interpret” means “treat device files as device nodes, not plain files”. – Stephen Kitt May 27 at 9:26
  • 1
    @n00b you can’t mount usersda, but you can at least use it to read from the underlying disk with no restrictions, and possibly write to it as well. You can easily copy all the disk’s contents, and with tools such as debuge2fs, overwrite /etc/shadow etc. – Stephen Kitt Aug 1 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.