[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230315094018.27d65aae@fabiankeil.de>
Date: Wed, 15 Mar 2023 09:40:18 +0100
From: Fabian Keil <freebsd-listen@...iankeil.de>
To: oss-security@...ts.openwall.com
Subject: Re: TTY pushback vulnerabilities / TIOCSTI
Shawn Webb <shawn.webb@...denedbsd.org> wrote on 2023-03-14 at 16:57:25:
> On Tue, Mar 14, 2023 at 09:51:03AM +0100, Hanno Böck wrote:
> > Hi,
> >
> > This blogpost highlights TTY Pushback vulnerabilities enabled via the
> > TIOCSTI kernel functionality available in the Linux kernel:
> > https://www.errno.fr/TTYPushback.html
> >
> > This has been discussed here previously:
> > https://www.openwall.com/lists/oss-security/2017/06/03/9
> >
> > Though I think there are some noteworthy updates. In the 2017 post
> > solar designer mentioned that the Linux kernel developers have multiple
> > times rejected changes in the kernel. However this has now changed:
> > Starting with Kernel 6.2 it is possible to disable TIOCSTI
> > (unset CONFIG_LEGACY_TIOCSTI). It also appears that very few (or no?)
> > applications practically use TIOCSTI.
> >
> > This seems to be the only real mitigation for this issue. It appears
> > su has a parameter, and in sudo one can configure the creation of a new
> > pty in the sudoers file. I don't consider these as satisfying fixes, as
> > they are optinal, and thus rely on the expectation that users are aware
> > of this risk and manually use these mitigations. That does not seem
> > realistic to me.
> >
> > This also affects such a large number of tools, not just
> > su/sudo-like tools, but also sandboxing tools. E.g. bubblewrap [1] is
> > affected by this by default.
> >
> > Thus I strongly recommend that people disable this in the kernel.
> >
> > [1] https://github.com/containers/bubblewrap/issues/555
>
> With commit c7d6d4bb4874720d9dab1625df62c2ea6eeb9df5[0], I've added a
> toggle in HardenedBSD to disable TIOCSTI. The toggle is set to
> prohibit TIOCSTI by default. Now attempts to use TIOCSTI will be met
> with EPERM.
In ElectroBSD I removed TIOCSTI support in 2017 [0] and haven't
noticed any problems.
According to the commit message "TIOCSTI is still used in tcsh,
but as tcsh isn't compiled on ElectroBSD we don't care".
> I've verified the toggle in a real-world scenario with the doas issue
> PoC found at [1].
I should probably do the same.
Fabian
[0]: <https://www.fabiankeil.de/sourcecode/electrobsd/ElectroBSD-20220822-d9391cfeef5b/0157-sys-kern-Follow-OpenBSD-s-lead-and-remove-TIOCSTI-sup.diff>
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
