oss-security - Re: TTY pushback vulnerabilities / TIOCSTI

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230317194102.wvso2ex65fuwbukg@jwilk.net>
Date: Fri, 17 Mar 2023 20:41:02 +0100
From: Jakub Wilk <jwilk@...lk.net>
To: <oss-security@...ts.openwall.com>
Subject: Re: TTY pushback vulnerabilities / TIOCSTI

* Hanno Böck <hanno@...eck.de>, 2023-03-17 11:48:
>Jakub Wilk <jwilk@...lk.net> wrote:
>
>>On Linux virtual terminals, it's possible to achieve pretty much the 
>>same effect using TIOCLINUX, the ioctl used by gpm to implement 
>>copy&pasting.
[...]
>Given this works only on "virtual terminals" (aka not in a terminal 
>window on X, not over SSH), I think the severity is much lower than the 
>TIOCSTI issue.

Agreed.

>I've created a patch for the Linux kernel very similar to the patch 
>that allows disabling TIOCSTI.

I don't think that's gonna fly, because...

>+	  The TIOCLINUX ioctl allows implementing copy-and-paste and
>+	  mouse operations in virtual terminals, used by tools like gpm.

TIOCLINUX implements also functionality unrelated to copying and 
pasting. See the ioctl_console(2) man page:
https://manpages.debian.org/unstable/manpages-dev/ioctl_console.2.en.html#TIOCLINUX

For example, apparently some of this stuff is used by systemd:

     $ git grep -wB5 TIOCLINUX
     src/basic/terminal-util.c-                int tiocl[2] = {
     src/basic/terminal-util.c-                        TIOCL_GETKMSGREDIRECT,
     src/basic/terminal-util.c-                        0
     src/basic/terminal-util.c-                };
     src/basic/terminal-util.c-
     src/basic/terminal-util.c:                if (ioctl(fd, TIOCLINUX, tiocl) < 0)
     --
     src/vconsole/vconsole-setup.c-static int verify_vc_device(int fd) {
     src/vconsole/vconsole-setup.c-        unsigned char data[] = {
     src/vconsole/vconsole-setup.c-                TIOCL_GETFGCONSOLE,
     src/vconsole/vconsole-setup.c-        };
     src/vconsole/vconsole-setup.c-
     src/vconsole/vconsole-setup.c:        return RET_NERRNO(ioctl(fd, TIOCLINUX, data));

-- 
Jakub Wilk

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.