[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <043b8fbe6e014f17@millert.dev>
Date: Tue, 18 Apr 2023 13:24:21 -0600
From: "Todd C. Miller" <Todd.Miller@...o.ws>
To: Ruihan Li <lrh2000@....edu.cn>
cc: Solar Designer <solar@...nwall.com>, oss-security@...ts.openwall.com
Subject: Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution
On Wed, 19 Apr 2023 02:59:26 +0800, Ruihan Li wrote:
> Yeah, I see that you are removing ioctl calls on standard file
> descriptors. So actually, just to confirm, it is feasible to avoid
> all ioctl calls to standard file descriptors with root privileges
> (under all command line arguments), by using /dev/tty, assuming
> something like the window size... Right?
For the most part, yes. There are still some calls to isatty(3)
using the standard file descriptors when setting up the event loop
to run the program but that is after the user has been verified.
I will add checks that the fd is a character special file before
calling isatty(3). In most cases the code wants the contents of
struct stat anyway, so the S_ISCHR check is basically free.
> If this is the case, I think it should not be difficult for other
> setuid programs to do similar things. I am just thinking for a
> while, and cannot find a case where ioctl calls are unavoidable.
If there are setuid programs that call ttyname(3) that will also
call tcgetattr(3). Also, the glibc getpass(3) function will use
tcgetattr(3) and tcsetattr(3) (to disable echo) on the standard
input if /dev/tty is not available. For getpass(3) this could be
avoided by only trying to disable echo when using /dev/tty. That
would change the behavior of things like:
su < /some/other/tty
when /dev/tty is unavailable but I don't know what use case that
would actually support.
- todd
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
