Possible failure to scrub data in file 'openbsd-compat/bsd-cray.c' in OpenSSH-7.1p1

[Bill Parker]

Hello All,

In reviewing some code in file 'bsd-cray.c', I found a possible
issue where data in the following code may not be properly scrubbed
in the case IA_BACKDOOR in function 'cray_setup', which is below:

case IA_BACKDOOR:
/* XXX: can we memset it to zero here so save some of this
*/
strlcpy(ue.ue_name, "root", sizeof(ue.ue_name));
strlcpy(ue.ue_dir, "/", sizeof(ue.ue_dir));
strlcpy(ue.ue_shell, "/bin/sh", sizeof(ue.ue_shell));

ue.ue_passwd[0] = '\0';
ue.ue_age[0] = '\0';
ue.ue_comment[0] = '\0';
ue.ue_loghost[0] = '\0';
ue.ue_logline[0] = '\0';

ue.ue_uid = -1;
ue.ue_nice[UDBRC_INTER] = 0;

where ue.ue_passwd[0] is set to NUL, there exists the potential that
any data beyond ue.ue_passwd[0] is still accessible in memory as the
following test program below demonstrates:

#include <stdio.h>

int main(void)
{
unsigned int n, l;
char ue[50] = "ABCDEFGHIJKLMNPOQRSTUVWXYZ0123456789";

ue[0] = '\0'; /* set this to NULL */

printf("Contents of char ue[0] is: %s\n", ue);

printf("Contents of char ue[1-36] is:");

for (n = 1; n < 36; n++)
printf("%c", ue[n]);
printf("\n");

return 0;
}

[***@moocow ~]$ ./a.out
Contents of char ue[0] is:
Contents of char ue[1-36] is:BCDEFGHIJKLMNPOQRSTUVWXYZ0123456789

As you can see, data beyond ue[0] is still accessible, should the
code not be changed to use memset() to scrub any sensitive information
still stored in various arrays in IA_BACKDOOR (and perhaps other
areas of code in bsd-cray.c, etc)?

Bill Parker (wp02855 at gmail dot com)

[Ben Lindstrom]

This is for UNICOS Cray. And currently I know that the OS and hardware
have been officially retired. I have a question into one of my contacts
at Cray to see if they know of any customers still running this old
hardware, and if not then I'd suggest we strip the UNICOS port out as
dead wood.

- Ben

Post by Bill Parker
Hello All,
In reviewing some code in file 'bsd-cray.c', I found a possible
issue where data in the following code may not be properly scrubbed
/* XXX: can we memset it to zero here so save some of this
*/
strlcpy(ue.ue_name, "root", sizeof(ue.ue_name));
strlcpy(ue.ue_dir, "/", sizeof(ue.ue_dir));
strlcpy(ue.ue_shell, "/bin/sh", sizeof(ue.ue_shell));
ue.ue_passwd[0] = '\0';
ue.ue_age[0] = '\0';
ue.ue_comment[0] = '\0';
ue.ue_loghost[0] = '\0';
ue.ue_logline[0] = '\0';
ue.ue_uid = -1;
ue.ue_nice[UDBRC_INTER] = 0;
where ue.ue_passwd[0] is set to NUL, there exists the potential that
any data beyond ue.ue_passwd[0] is still accessible in memory as the
#include<stdio.h>
int main(void)
{
unsigned int n, l;
char ue[50] = "ABCDEFGHIJKLMNPOQRSTUVWXYZ0123456789";
ue[0] = '\0'; /* set this to NULL */
printf("Contents of char ue[0] is: %s\n", ue);
printf("Contents of char ue[1-36] is:");
for (n = 1; n< 36; n++)
printf("%c", ue[n]);
printf("\n");
return 0;
}
Contents of char ue[1-36] is:BCDEFGHIJKLMNPOQRSTUVWXYZ0123456789
As you can see, data beyond ue[0] is still accessible, should the
code not be changed to use memset() to scrub any sensitive information
still stored in various arrays in IA_BACKDOOR (and perhaps other
areas of code in bsd-cray.c, etc)?
Bill Parker (wp02855 at gmail dot com)
_______________________________________________
openssh-unix-dev mailing list
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

[Michael Stone]

Post by Ben Lindstrom
This is for UNICOS Cray. And currently I know that the OS and
hardware have been officially retired. I have a question into one of
my contacts at Cray to see if they know of any customers still running
this old hardware, and if not then I'd suggest we strip the UNICOS
port out as dead wood.

+1. There were a lot of oddities about programming on those machines and
if nobody's been actively testing there's a good chance that it's not
working right anyway.

Mike Stone