CVE-2019-15901 in doas
Summary
by MITRE
An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change the UID, primary GID, and secondary GIDs was replaced (on certain platforms: Linux and possibly NetBSD) with a single setuid(2) call. This resulted in neither changing the group id nor initializing secondary group ids.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/17/2024
The vulnerability identified as CVE-2019-15901 affects the doas utility version 6.1 and earlier on platforms other than OpenBSD, specifically impacting Linux and potentially NetBSD systems. This issue stems from a critical flaw in privilege management implementation where the software fails to properly handle user context changes during authentication processes. The vulnerability manifests when the application attempts to switch user identities using the setusercontext function, which should typically manage complete user context transitions including UID, primary GID, and secondary GIDs. However, on affected platforms, this function is incorrectly replaced with a simpler setuid system call that only modifies the user ID while completely neglecting group ID modifications and secondary group initialization.
The technical flaw represents a fundamental misimplementation of privilege escalation procedures that directly violates established security principles. According to CWE-254, this vulnerability falls under the category of "Security Features" where the system fails to properly implement access control mechanisms. The core issue lies in the improper handling of group memberships, which creates a scenario where a user may gain elevated privileges but maintains incorrect group context. This misconfiguration can lead to privilege escalation attacks where an attacker can gain access to resources that should be restricted to specific group memberships. The vulnerability operates at the system call level where the application bypasses proper group context management by using setuid(2) instead of the more comprehensive setusercontext(3) function that would properly initialize all user context elements.
The operational impact of this vulnerability extends beyond simple privilege escalation to create potential security boundaries that can be easily circumvented. When secondary group IDs are not properly initialized, users may inadvertently gain access to files, directories, or network resources that should only be accessible to specific group memberships. This creates a scenario where an attacker could potentially access sensitive data or system resources that are protected by group-based access controls. The vulnerability affects systems where doas is used as a privilege escalation tool, making it particularly dangerous in environments where users need to execute commands with elevated privileges while maintaining proper security boundaries. According to ATT&CK framework technique T1068, this vulnerability enables local privilege escalation by exploiting weaknesses in privilege management and user context handling, potentially allowing attackers to bypass security controls that rely on proper group membership validation.
Mitigation strategies for this vulnerability require immediate patching of the doas utility to version 6.2 or later, which contains the corrected implementation that properly handles user context transitions. System administrators should verify that all affected systems have been updated and confirm that the proper setusercontext implementation is being used instead of the simplified setuid approach. Additionally, monitoring should be implemented to detect any unauthorized privilege escalation attempts that might occur due to this group context issue. Organizations should also review their privilege escalation policies and ensure that alternative authentication methods are properly configured to prevent exploitation of this vulnerability. The fix addresses the root cause by restoring proper group ID management during user context transitions, ensuring that all group memberships are correctly initialized and maintained during privilege changes. This remediation aligns with security best practices for privilege management and helps maintain the integrity of system access controls that depend on proper user and group context handling.