Subject: Re: Privilege escalation to group "ssh" in ssh-agent via openssl library
From: "Theo de Raadt" <deraadt -at- ...
To: halfdog <me -at- ...
Date: Sun, 17 Dec 2017 15:24:57 -0700

BTW,

libressl has that getenv stuff completely removed.  I removed it myself.

You might want to mention that, because that does a better job of
delineating which systems are affected by this.

I was the designer of the issetugid() API.  It is supposed to have
more powerful semantics than the terrible OpenSSL emulation.  I have
railed before at people making retrograde emulations which don't
satisfy the requirement.  I told them years ago.  They didn't care.
Probably needed to be a paying customer.

In OpenBSD we always protect library environment access with that
system call.  Over time we have been decreasing environment variable
access to the minimum when possible.  It is a battle.

But of course they didn't see the wisdom of using it to protect the
access, therefore the problem.

You understand the use of the gid correctly.  On some systems there
are ptrace-blocking features, but quite a few systems have weaknesses
in that also and aren't as effective as this kind of nul priv-switch.