[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230402193310.0e2be5bb.hanno@hboeck.de>
Date: Sun, 2 Apr 2023 19:33:10 +0200
From: Hanno Böck <hanno@...eck.de>
To: Greg KH <gregkh@...uxfoundation.org>
Cc: kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH] Restrict access to TIOCLINUX
On Sun, 2 Apr 2023 19:23:44 +0200
Greg KH <gregkh@...uxfoundation.org> wrote:
> > Do you have other proposals how to fix this issue? One could
> > introduce an option like for TIOCSTI that allows disabling
> > selection features by default.
>
> What exact issue are you trying to fix here?
The fact that the selection features of TIOCLINUX can be used for
privilege escalation.
I already mentioned this in the original patch description, but I think
the minitty.c example here illustrates this well:
https://www.openwall.com/lists/oss-security/2023/03/14/3
Compile it, do
sudo -u [anynonprivilegeduser] ./minitty
It'll execute shell code with root permission.
--
Hanno Böck
https://hboeck.de/
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
