CVE-2019-15900 in doas
Summary
by MITRE
An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/17/2024
The vulnerability identified as CVE-2019-15900 affects the doas utility version 6.2 and earlier, specifically on platforms other than OpenBSD where the strtonum(3) function is not available. This flaw represents a critical authorization bypass vulnerability that undermines the security model of the doas command. The issue stems from improper error handling mechanisms within the command parsing logic, creating a scenario where malicious input can bypass authentication checks and escalate privileges.
The technical root cause of this vulnerability lies in the implementation of input validation routines within the doas utility. When certain platforms lack the strtonum(3) function, the code falls back to using sscanf for parsing numeric inputs. However, the developers failed to properly implement error checking for the sscanf function calls. Instead of verifying whether sscanf successfully parsed the input values, the code incorrectly relied on checking an uninitialized variable errstr. This uninitialized variable would contain arbitrary memory contents and would, in many cases, incorrectly indicate successful parsing even when sscanf had actually failed to process the input properly.
The operational impact of this vulnerability is severe as it allows for privilege escalation attacks. When a user provides invalid username or group name inputs to the doas command, the system should properly reject these inputs and refuse to execute commands with elevated privileges. However, due to the flawed error handling, the system incorrectly processes malformed inputs and proceeds to execute commands as root. This creates a situation where unauthorized users can potentially execute arbitrary commands with administrative privileges, effectively bypassing the intended access controls and authentication mechanisms.
This vulnerability maps to CWE-252, which describes "Unchecked Return Value" in software security contexts. The flaw demonstrates a classic example of failing to validate function return codes, specifically the sscanf function which returns the number of input items successfully parsed. When this return value is not properly checked, the program continues execution assuming successful parsing even when the input processing has failed. From an attack perspective, this vulnerability aligns with ATT&CK technique T1068, which covers "Exploitation for Privilege Escalation" and specifically addresses how adversaries can leverage software flaws to gain elevated privileges.
The mitigation strategy for this vulnerability requires immediate patching of the doas utility to version 6.2 or later, which contains the corrected error handling implementation. Organizations should also implement monitoring for unauthorized privilege escalation attempts and ensure that all systems running doas are updated to versions that properly validate input parsing results. Additionally, security teams should conduct audits of similar code patterns across other system utilities to identify and remediate potential instances of uninitialized variable usage and improper error handling that could lead to similar privilege escalation vulnerabilities.