[Secure-testing-team] Bug#770692: python-pyopencl: Insecure temporary file creation for kernel cache

[Bruce Merry]

Package: python-pyopencl
Severity: grave
Tags: upstream security
Justification: user security hole

Dear Maintainer,

PyOpenCL creates a cache of compiled kernels in a predictable location in the
temporary directory. Assuming a system-wide /tmp, an attacker can exploit this.
This allows for arbitrary code execution on OpenCL devices (which could be a
CPU); the cache also contains a Python pickle file, which may allow another
route to arbitrary code execution.

https://github.com/pyopencl/pyopencl/pull/68 contains an upstream patch to fix
the issue by storing the cache in the XDG per-user cache directory instead of
the temporary temporary.

I happen to be running Ubuntu Trusty on the machine where I first discovered
this, but it presumably affects any UNIX system with a shared system temporary
directory.



-- System Information:
Debian Release: jessie/sid
  APT prefers trusty-updates
  APT policy: (500, 'trusty-updates'), (500, 'trusty-security'), (500, 'trusty'), (100, 'trusty-backports')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.13.0-39-generic (SMP w/8 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash