Re: [PATCH v2 0/2] QGA installer fixes

[Brian Wiltse]

Microsoft has a list of best practices for MSI creation which covers custom actions https://learn.microsoft.com/en-us/windows/win32/msi/windows-installer-best-practices#if-you-use-custom-actions-follow-good-custom-action-practices, The change to the custom action from an interactive command shell to a silent invocation of rundll32.exe keeps the interactive shell from being easily caught and abused, but this does not fully solve the repair from being triggered from a non admin user. There is still the potential for abuse indirectly via attacks like the Mitre documented Hijack Execution Flow technique - Path Interception by PATH Environment Variable (https://attack.mitre.org/techniques/T1574/007/), or even the abuse of potential arbitrary folder creates, file writes and deletes in user-controlled areas such as C:\ProgramData.

The Change button was removed from "Programs and Features", but the cached installer in c:\windows\installer can be leveraged directly to start a privileged repair with msiexec.exe as a non-administrative user. Ideally, the MSI would be compiled with the Privileged property https://learn.microsoft.com/en-us/windows/win32/msi/privileged or AdminUser property https://learn.microsoft.com/en-us/windows/win32/msi/adminuser or InstallPrivileges="Elevated" https://wixtoolset.org/docs/v3/xsd/wix/package/ or similar privilege check that which would help ensure the user has proper privileges to perform the repair or change action. However, since the QEMU build process leverages WiXL from msitools, many of the WiX property types are not currently supported to leverage as solutions ( i.e. (wixl:1077): GLib-GObject-WARNING **: 17:49:05.477: g_object_set_is_valid_property: object class 'WixlWixPackage' has no property named 'InstallPrivileges' ). This similar to wixl issue 40 https://gitlab.gnome.org/GNOME/msitools/-/issues/40.

I do see that Wixl appears to support the custom action JScriptCall. This might provide for a facility for a script could be run to check if the user has the proper privileges before privileged actions are taken in the repair process, but this is not an ideal solution.

Thanks,

Brian

---

From: Konstantin Kostiuk <kkostiuk@redhat.com>
Sent: Monday, February 27, 2023 2:18 AM
To: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: qemu-devel@nongnu.org <qemu-devel@nongnu.org>; Daniel P . Berrangé <berrange@redhat.com>; Bin Meng <bin.meng@windriver.com>; Stefan Weil <sw@weilnetz.de>; Yonggang Luo <luoyonggang@gmail.com>; Markus Armbruster <armbru@redhat.com>; Alex Bennée <alex.bennee@linaro.org>; Peter Maydell <peter.maydell@linaro.org>; Gerd Hoffmann <kraxel@redhat.com>; Michael S. Tsirkin <mst@redhat.com>; Thomas Huth <thuth@redhat.com>; Marc-André Lureau <marcandre.lureau@redhat.com>; Michael Roth <michael.roth@amd.com>; Mauro Matteo Cascella <mcascell@redhat.com>; Yan Vugenfirer <yvugenfi@redhat.com>; Evgeny Iakovlev <eiakovlev@linux.microsoft.com>; Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>; Xuzhou Cheng <xuzhou.cheng@windriver.com>; Brian Wiltse <brian.wiltse@live.com>
Subject: Re: [PATCH v2 0/2] QGA installer fixes

 

ping

On Tue, Feb 21, 2023 at 1:41 PM Philippe Mathieu-Daudé <philmd@linaro.org> wrote:

On 21/2/23 12:21, Konstantin Kostiuk wrote:. For example
> resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2167423
> fixes: CVE-2023-0664
>
> CVE Technical details: The cached installer for QEMU Guest Agent in c:\windows\installer
> (https://github.com/qemu/qemu/blob/master/qga/installer/qemu-ga.wxs),
> can be leveraged to begin a repair of the installation without validation
> that the repair is being performed by an administrative user. The MSI repair
> custom action "RegisterCom" and "UnregisterCom" is not set for impersonation
> which allows for the actions to occur as the SYSTEM account
> (LINE 137 AND 145 of qemu-ga.wxs). The custom action also leverages cmd.exe
> to run qemu-ga.exe in line 134 and 142 which causes an interactive command
> shell to spawn even though the MSI is set to be non-interactive on line 53.
>
> v1: https://lists.nongnu.org/archive/html/qemu-devel/2023-02/msg05661.html

Per
CAA8xKjUQFBVgDVJ059FvGoSjkv+kZ5jB1gfMNz+ao-twH7FDRg@mail.gmail.com/" data-auth="NotApplicable">https://lore.kernel.org/qemu-devel/CAA8xKjUQFBVgDVJ059FvGoSjkv+kZ5jB1gfMNz+ao-twH7FDRg@mail.gmail.com/:

Reported-by: Brian Wiltse <brian.wiltse@live.com>

> v1 -> v2:
>    Add explanation into commit messages

Thanks, much appreciated!

> Konstantin Kostiuk (2):
>    qga/win32: Remove change action from MSI installer
>    qga/win32: Use rundll for VSS installation
>
>   qga/installer/qemu-ga.wxs | 11 ++++++-----
>   qga/vss-win32/install.cpp |  9 +++++++++
>   qga/vss-win32/qga-vss.def |  2 ++
>   3 files changed, 17 insertions(+), 5 deletions(-)
>
> --
> 2.25.1
>