su-exec Privilege Escalation via Truncated UID/GID

Executive Summary

su-exec through version 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning them to uid_t and gid_t. This allows large numeric values to truncate to zero, which corresponds to root's identifier. Attackers can exploit this to cause su-exec to execute programs with root privileges instead of intended unprivileged accounts.

Useful 0 Not Useful 0

Detection Guidance

Check if su-exec version 0.3 or earlier is installed by running: su-exec --version or ls -l $(which su-exec). Inspect the source code for improper strtol usage in su-exec.c, particularly where UID/GID parsing lacks range validation. Look for processes running with root privileges unexpectedly.

Useful 0 Not Useful 0

Impact Analysis

An attacker controlling runtime identity values (e.g., PUID/PGID) can bypass privilege drops, gaining root-level access within the container. This allows access to root-only files, writing to root-owned files, and performing privileged operations like chown. The impact is high as it undermines the intended privilege separation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to escalate privileges to root within containers, potentially bypassing intended access controls. For GDPR, this could lead to unauthorized access to personal data, violating principles of data protection and integrity. Under HIPAA, root access in healthcare systems might expose protected health information, violating security rules for electronic protected health information (ePHI).

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade su-exec to the latest patched version immediately. If upgrading is not possible, replace strtol with strict unsigned parsing like strtoumax and add range checks for UID/GID values. Avoid using numeric IDs and switch to named user/group specifications where possible.

Useful 0 Not Useful 0