Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CVE-2022-26488] Escalation of privilege via Windows Installer #91104

Closed
zooba opened this issue Mar 7, 2022 · 16 comments
Closed

[CVE-2022-26488] Escalation of privilege via Windows Installer #91104

zooba opened this issue Mar 7, 2022 · 16 comments
Assignees
@zooba
Labels
3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes 3.11 only security fixes OS-windows release-blocker type-security A security issue

Comments

@zooba
Copy link
Member

zooba commented Mar 7, 2022

BPO 46948
Nosy @gpshead, @pfmoore, @tjguk, @ned-deily, @ambv, @zware, @zooba, @pablogsal, @miss-islington
PRs
  • bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair #31726
  • [3.10] bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair #31727
  • [3.9] bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair #31728
  • [3.8] bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair #31729
  • [3.7] bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair #31730
  • bpo-46948: Fix launcher installer build failure due to first part of fix #31920
  • [3.10] bpo-46948: Fix launcher installer build failure due to first part of fix (GH-31920) #31922
  • [3.9] bpo-46948: Fix launcher installer build failure due to first part of fix (GH-31920) #31923
  • [3.8] bpo-46948: Fix launcher installer build failure due to first part of fix (GH-31920) #31924
  • [3.7] bpo-46948: Fix launcher installer build failure due to first part of fix (GH-31920) #31925
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/zooba'
closed_at = <Date 2022-03-16.12:23:48.554>
created_at = <Date 2022-03-07.16:33:17.993>
labels = ['type-security', '3.8', '3.9', '3.10', '3.11', '3.7', 'release-blocker', 'OS-windows']
title = '[CVE-2022-26488] Escalation of privilege via Windows Installer'
updated_at = <Date 2022-03-16.12:23:48.554>
user = 'https://github.com/zooba'

    bugs.python.org fields:

    activity = <Date 2022-03-16.12:23:48.554>
actor = 'steve.dower'
assignee = 'steve.dower'
closed = True
closed_date = <Date 2022-03-16.12:23:48.554>
closer = 'steve.dower'
components = ['Windows']
creation = <Date 2022-03-07.16:33:17.993>
creator = 'steve.dower'
dependencies = []
files = []
hgrepos = []
issue_num = 46948
keywords = ['patch']
message_count = 16.0
messages = ['414673', '414678', '414679', '414681', '414682', '414683', '414685', '414711', '414733', '414752', '415306', '415309', '415310', '415314', '415317', '415331']
nosy_count = 9.0
nosy_names = ['gregory.p.smith', 'paul.moore', 'tim.golden', 'ned.deily', 'lukasz.langa', 'zach.ware', 'steve.dower', 'pablogsal', 'miss-islington']
pr_nums = ['31726', '31727', '31728', '31729', '31730', '31920', '31922', '31923', '31924', '31925']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue46948'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']
    @zooba
    Copy link
    Member Author

    zooba commented Mar 7, 2022

    CVE-2022-26488 is an escalation of privilege vulnerability in the Windows installer for the following releases of CPython:

    • 3.11.0a6 and earlier
    • 3.10.2 and earlier
    • 3.9.10 and earlier
    • 3.8.12 and earlier
    • All end-of-life releases of 3.5, 3.6 and 3.7

    The vulnerability exists when installed for all users, and when the "Add Python to PATH" option has been selected. A local user without administrative permissions can trigger a repair operation that adds incorrect additional paths to the system PATH variable, and then use search path hijacking to achieve escalation of privilege. Per-user installs (the default) are also affected, but cannot be used for escalation of privilege.

    Besides updating, this vulnerability may be mitigated by modifying an existing install to disable the "Add Python to PATH" or "Add Python to environment variables" option. Manually adding the install directory to PATH is not affected.

    Thanks to the Lockheed Martin Red Team for detecting and reporting the issue to the Python Security Response Team.

    @zooba zooba added 3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes 3.11 only security fixes release-blocker labels Mar 7, 2022
    @zooba zooba self-assigned this Mar 7, 2022
    @zooba zooba added OS-windows 3.8 only security fixes type-security A security issue 3.9 only security fixes 3.10 only security fixes 3.11 only security fixes release-blocker labels Mar 7, 2022
    @zooba zooba self-assigned this Mar 7, 2022
    @zooba zooba added OS-windows type-security A security issue labels Mar 7, 2022
    @pablogsal
    Copy link
    Member

    The 3.11.0a6 release is ongoing. I assume is ok to not block this release on this issue, given that an alpha is inherently unsafe

    @zooba
    Copy link
    Member Author

    zooba commented Mar 7, 2022

    Yeah, this is fine to still be in alpha 6. Very unlikely that anyone is making it a system-wide default anyway, and certainly not in secure/production systems.

    @zooba
    Copy link
    Member Author

    zooba commented Mar 7, 2022

    New changeset 136842c by Steve Dower in branch '3.10':
    bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair (GH-31727)
    136842c

    @zooba
    Copy link
    Member Author

    zooba commented Mar 7, 2022

    New changeset 77446d2 by Steve Dower in branch 'main':
    bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair (GH-31726)
    77446d2

    @zooba
    Copy link
    Member Author

    zooba commented Mar 7, 2022

    New changeset 101a1be by Steve Dower in branch '3.9':
    bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair (GH-31728)
    101a1be

    @ned-deily
    Copy link
    Member

    New changeset 9747627 by Steve Dower in branch '3.7':
    bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair (GH-31730)
    9747627

    @gpshead
    Copy link
    Member

    gpshead commented Mar 8, 2022

    Is there anything on our end we can do to prevent this kind of issue in the future?

    Am I wrong to see this as just fixing our package to avoid a design flaw in Windows OS level package management?

    Certainly other packages in the world must run into similar problems.

    @ambv
    Copy link
    Contributor

    ambv commented Mar 8, 2022

    New changeset cff1b78 by Steve Dower in branch '3.8':
    bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair (GH-31729)
    cff1b78

    @zooba
    Copy link
    Member Author

    zooba commented Mar 8, 2022

    Is there anything on our end we can do to prevent this kind of issue in the future?

    Probably not, I think it's just a lesson learned about the capabilities of the MSI format and its integration with Windows (well, we could hurry up moving everyone to the Windows Store, which doesn't have this issue, but that seems unlikely ;) )

    Similar issues have been reported to the Windows Installer team (e.g. CVE-2021-41379, CVE-2021-26415) that could have been fixed by disabling the unelevated repair function, but weren't. So I think it just has to become a known thing for people building MSIs that a "repair" can be run by non-elevated users, and install-time variables may not be preserved for the repair. (In our case, that means actually searching for the existing install rather than trusting the variable our bundle normally provides to the MSI.)

    @zooba zooba closed this as completed Mar 8, 2022
    @zooba zooba closed this as completed Mar 8, 2022
    @zooba
    Copy link
    Member Author

    zooba commented Mar 16, 2022

    The fix for this regressed the installer for the py.exe launcher, which breaks our release builds.

    I'm patching it now. It's going under the same issue number because it will be needed for anyone applying this patch directly and then building the installer themselves.

    @zooba zooba reopened this Mar 16, 2022
    @zooba zooba reopened this Mar 16, 2022
    @zooba
    Copy link
    Member Author

    zooba commented Mar 16, 2022

    New changeset 7088120 by Steve Dower in branch 'main':
    bpo-46948: Fix launcher installer build failure due to first part of fix (GH-31920)
    7088120

    @miss-islington
    Copy link
    Contributor

    New changeset 58d30b9 by Miss Islington (bot) in branch '3.10':
    bpo-46948: Fix launcher installer build failure due to first part of fix (GH-31920)
    58d30b9

    @miss-islington
    Copy link
    Contributor

    New changeset 70eb9db by Miss Islington (bot) in branch '3.9':
    bpo-46948: Fix launcher installer build failure due to first part of fix (GH-31920)
    70eb9db

    @ned-deily
    Copy link
    Member

    New changeset 4a1d65f by Miss Islington (bot) in branch '3.7':
    bpo-46948: Fix launcher installer build failure due to first part of fix (GH-31920) (GH-31925)
    4a1d65f

    @ambv
    Copy link
    Contributor

    ambv commented Mar 16, 2022

    New changeset 2b97cfd by Miss Islington (bot) in branch '3.8':
    bpo-46948: Fix launcher installer build failure due to first part of fix (GH-31920) (GH-31924)
    2b97cfd

    @zooba zooba closed this as completed Mar 16, 2022
    @zooba zooba closed this as completed Mar 16, 2022
    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees

    @zooba zooba

    Labels
    3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes 3.11 only security fixes OS-windows release-blocker type-security A security issue
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    6 participants
    @ambv @gpshead @zooba @ned-deily @pablogsal @miss-islington