CVE-2023-29491
📋 TL;DR
This vulnerability in ncurses allows local users to trigger memory corruption by providing malformed terminfo database files. It affects setuid applications using vulnerable ncurses versions, potentially allowing privilege escalation. The issue stems from improper validation of terminfo data.
💻 Affected Systems
- ncurses
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root via exploitation of setuid applications, leading to complete system compromise.
Likely Case
Local privilege escalation to the user running the setuid application, potentially gaining elevated privileges.
If Mitigated
No impact if proper file permissions prevent users from writing to terminfo directories or if setuid applications don't use vulnerable ncurses functions.
🎯 Exploit Status
Exploitation requires local access and knowledge of vulnerable setuid applications. Proof-of-concept code has been published in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ncurses 6.4 20230408 and later
Vendor Advisory: http://ncurses.scripts.mit.edu/?p=ncurses.git%3Ba=commit%3Bh=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56
Restart Required: No
Instructions:
1. Update ncurses package to version 6.4 20230408 or later. 2. For Debian/Ubuntu: apt update && apt upgrade ncurses. 3. For RHEL/CentOS: yum update ncurses. 4. For Fedora: dnf update ncurses. 5. Recompile any applications statically linked to vulnerable ncurses versions.
🔧 Temporary Workarounds
Restrict terminfo directory permissions
linuxPrevent users from writing to terminfo directories that setuid applications might access.
chmod 755 /usr/share/terminfo
chmod 755 $HOME/.terminfo
chmod 755 /etc/terminfo
Remove setuid bit from vulnerable applications
linuxRemove setuid permissions from applications using ncurses until patched.
chmod u-s /path/to/vulnerable/application
🧯 If You Can't Patch
- Remove or disable setuid applications that use ncurses
- Implement strict file permissions on terminfo directories and user home directories
🔍 How to Verify
Check if Vulnerable:
Check ncurses version: ncursesw6-config --version or dpkg -l libncurses* | grep ^iiCheck Version:
ncursesw6-config --version || dpkg -l libncurses* | grep ^ii || rpm -q ncursesVerify Fix Applied:
Verify installed ncurses version is 6.4 20230408 or later: ncursesw6-config --version | grep -q '6.4' && echo 'Patched'📡 Detection & Monitoring
Log Indicators:
- Failed setuid executions
- Abnormal terminfo file access patterns
- Memory corruption errors in application logs
Network Indicators:
- None - this is a local exploit
SIEM Query:
process.name:setuid AND file.path:/usr/share/terminfo/* OR file.path:$HOME/.terminfo/*🔗 References
- http://ncurses.scripts.mit.edu/?p=ncurses.git%3Ba=commit%3Bh=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56
- http://www.openwall.com/lists/oss-security/2023/04/19/10
- http://www.openwall.com/lists/oss-security/2023/04/19/11
- https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/
- https://security.netapp.com/advisory/ntap-20230517-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- https://www.openwall.com/lists/oss-security/2023/04/12/5
- https://www.openwall.com/lists/oss-security/2023/04/13/4
- http://ncurses.scripts.mit.edu/?p=ncurses.git%3Ba=commit%3Bh=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56
- http://www.openwall.com/lists/oss-security/2023/04/19/10
- http://www.openwall.com/lists/oss-security/2023/04/19/11
- https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/
- https://security.netapp.com/advisory/ntap-20230517-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- https://www.openwall.com/lists/oss-security/2023/04/12/5
- https://www.openwall.com/lists/oss-security/2023/04/13/4
