[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20240131225840.w7bgmi32juh6wcpz@jwilk.net>
Date: Wed, 31 Jan 2024 23:58:40 +0100
From: Jakub Wilk <jwilk@...lk.net>
To: <oss-security@...ts.openwall.com>
CC: halfdog <me@...fdog.net>
Subject: Re: TTY handling when executing code in different
lower-privileged context (su, virt containers)
I'm a few years late, but hey.
* halfdog <me@...fdog.net>, 2012-11-05 19:22:
>The basic idea is, that a program started from interactive shell can
>access the TTY and also inject input data using TIOCSTI ioctl.
[…]
>In both cases, paranoid administrators might decide to use /dev/null as
>stdin/stdout/stderr
Redirecting unneeded fds is a good idea, but alone it's not sufficient
to defeat the attack. The unprivileged process could open /dev/tty and
then issue TIOCSTI on that fd.
>[1] http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/
This insufficient work-around is also mentioned on the website:
"When no interactive shell is needed in lower-privileged context, su et
al. can be run with stdin, stdout, stderr redirection, not passing a
tty-fd to the other context"
--
Jakub Wilk
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
