<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif"></div><div class="gmail_quote"><div dir="ltr"><div style="font-family:tahoma,sans-serif">Hi guys, I'm writing <span class="gmail_default" style="font-family:tahoma,sans-serif">to this mailing list</span> since <span class="gmail_default" style="font-family:tahoma,sans-serif"></span><span class="gmail_default" style="font-family:tahoma,sans-serif">I've already shared the details with both Benjamin Berg and Marco Trevisan in private and we have yet to come to a conclusion about this vulnerability.</span></div><div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif">My sudo is configured to approve access with pam_fprintd, this is the config file:</div><div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif"><span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">#%PAM-1.0 </span><br> <br>auth sufficient pam_fprintd.so <br>auth include system-auth <br>account include system-auth <br>session include system-auth<br></span></div><div style="font-family:tahoma,sans-serif"><span style="font-family:monospace"><br></span></div><div style="font-family:tahoma,sans-serif">So, unless I'm not already authenticated, running the following command:<span style="font-family:monospace"><br></span></div><div style="font-family:tahoma,sans-serif"><span style="font-family:monospace">sudo whoami</span></div>Replies with the following prompt:<div style="font-family:tahoma,sans-serif"><span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">Place your finger on the fingerprint reader</span></span></div><div style="font-family:tahoma,sans-serif"><span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"><br></span></span></div>Placing my finger on the fingerprint reader leads to the following output:<div style="font-family:tahoma,sans-serif"><span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">root<br></span></span></div><div style="font-family:tahoma,sans-serif"><span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"><br></span></span></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"><span class="gmail_default" style="font-family:tahoma,sans-serif">The security </span><span class="gmail_default" style="font-family:tahoma,sans-serif">concern</span> is that this process can also happen behind the scenes, so if I'm running a script that has a sudo prompt to delete something I care about, I can accidentally place my fingerprint on the fingerprint reader for any other reasons, and my beloved files will be removed.</span></font></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"><br></span></font></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">How to recreate the issue?</span></font></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">Open your favorite console app on Linux.</span></font></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">If it supports tabs open two tabs, if not just open another window.</span></font></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">On the first tab type: </span></font><span style="font-family:monospace"><span style="color:rgb(24,178,24);background-color:rgb(255,255,255)">sudo</span><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"> </span><span style="color:rgb(24,178,24);background-color:rgb(255,255,255)">whoami</span><br></span></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">Switch to the second tab and type: </span></font><span style="font-family:monospace"><span style="color:rgb(24,178,24);background-color:rgb(255,255,255)">echo</span><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"> Place your finger on the fingerprint reader;</span><span style="color:rgb(24,178,24);background-color:rgb(255,255,255)">cat</span><br></span></div><div style="font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif">Place your fingerprint on the fingerprint reader</span></div><div><span style="font-family:arial,sans-serif">Return to the first tab (You should see that the command was approved and the output is root)<br></span></div><div style="font-family:tahoma,sans-serif"><span style="font-family:arial,sans-serif"><br></span></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif">Assume the user was running some background process and didn't see the fingerprint prompt from the other terminal. The second terminal might somehow deceive the user into placing the finger on the fingerprint reader and elevating permissions without the user being fully aware.</font></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif"><br></font></div><div style="font-family:tahoma,sans-serif"><div style="font-family:tahoma,sans-serif"><span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"><span class="gmail_default" style="font-family:tahoma,sans-serif">On Ubuntu, if I want to recreate the same configuration, all I have to do is simply enroll my fingerprints in System Settings,</span></span></span></div><div style="font-family:tahoma,sans-serif"><span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"><span class="gmail_default" style="font-family:tahoma,sans-serif">then install the </span></span><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"><span class="gmail_default">pam-auth-update</span></span><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"><span class="gmail_default" style="font-family:tahoma,sans-serif"> and select the Fingerprint authentication from the selection screen (apt specific) as described in the following SO thread: </span></span></span><a href="https://askubuntu.com/questions/1015416/use-fingerprint-authentication-not-only-for-login">https://askubuntu.com/questions/1015416/use-fingerprint-authentication-not-only-for-login</a></div></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif"><br></font></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif">This problem was solved in macOS by simply displaying a window, and if the window is out of focus, the fingerprint won't work.</font></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif">Since we can't rely on any graphical window on Linux since it can be terminal only, we need to somehow make sure that the user fingerprint is used only for the sole purpose of the request and with full attention to the specific action the fingerprint was requested for. Otherwise, the fingerprint can be hijacked (just like clickjacking).</font></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif"><br></font></div><span class="gmail_default" style="font-family:tahoma,sans-serif">Benjamin was kind enough to respond and I allowed myself to summarize his </span><span class="gmail_default" style="font-family:tahoma,sans-serif">reply:</span></div><div><span class="gmail_default" style="font-family:tahoma,sans-serif">It can happen with fprintd as with any other external authentication method (aside from password, we have Bluetooth proximity, NFC Tag, Smart Card, etc.), so it is not unique to fprintd.</span></div><div><span class="gmail_default" style="font-family:tahoma,sans-serif">Benjamin also offered some ways to mitigate such as changing the configuration or using pkexec instead of sudo.<br></span></div><div><span class="gmail_default" style="font-family:tahoma,sans-serif"><br></span></div><div><span class="gmail_default" style="font-family:tahoma,sans-serif">I addressed this issue with the sudo maintainer, Todd C. Miller, and again I allowed myself to summarize his response:<br></span></div><div dir="ltr">Although I understand the concern, I can't see any way to fix it without a security attention mechanism.</div><div dir="ltr"><br></div><div dir="ltr"><div style="font-family:tahoma,sans-serif" class="gmail_default">CVSS 4.0 ranked this CVE as 7.3.</div><br><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif">Thank you,<br></font></div><div style="font-family:tahoma,sans-serif"><font face="arial,sans-serif">PS, I'm not a security researcher and I'm not affiliated with any organization.<br></font></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><span style="font-size:large"><span style="font-family:georgia,serif"><font color="#990000" style="--darkreader-inline-color: #ff6161;">Yaron</font></span><font color="#330000" style="--darkreader-inline-color: #d8d5cf;"><span style="font-family:georgia,serif"> <font size="4"><span style="font-family:times new roman,serif">Shahrabani</span></font></span></font></span><blockquote style="margin:0px 0px 0px 40px;border:medium;padding:0px"><div><font color="#666666" style="--darkreader-inline-color: #a8a095;"><span style="font-size:x-small"><font color="#FF0000" style="--darkreader-inline-color: #ff1a1a;"><</font></span><font size="2"><span style="font-family:monospace">DevOps</span> - <span style="font-family:garamond,serif">Hebrew translator</span></font><span style="font-size:x-small"><font color="#FF0000" style="--darkreader-inline-color: #ff1a1a;">></font></span></font></div></blockquote></div></div></div></div></div></div></div></div> </div></div>