oss-sec mailing list archives
TTY pushback vulnerabilities / TIOCSTI
From: Hanno Böck <hanno () hboeck de>
Date: Tue, 14 Mar 2023 09:51:03 +0100
Hi, This blogpost highlights TTY Pushback vulnerabilities enabled via the TIOCSTI kernel functionality available in the Linux kernel: https://www.errno.fr/TTYPushback.html This has been discussed here previously: https://www.openwall.com/lists/oss-security/2017/06/03/9 Though I think there are some noteworthy updates. In the 2017 post solar designer mentioned that the Linux kernel developers have multiple times rejected changes in the kernel. However this has now changed: Starting with Kernel 6.2 it is possible to disable TIOCSTI (unset CONFIG_LEGACY_TIOCSTI). It also appears that very few (or no?) applications practically use TIOCSTI. This seems to be the only real mitigation for this issue. It appears su has a parameter, and in sudo one can configure the creation of a new pty in the sudoers file. I don't consider these as satisfying fixes, as they are optinal, and thus rely on the expectation that users are aware of this risk and manually use these mitigations. That does not seem realistic to me. This also affects such a large number of tools, not just su/sudo-like tools, but also sandboxing tools. E.g. bubblewrap [1] is affected by this by default. Thus I strongly recommend that people disable this in the kernel. [1] https://github.com/containers/bubblewrap/issues/555 -- Hanno Böck https://hboeck.de/
Current thread:
- TTY pushback vulnerabilities / TIOCSTI Hanno Böck (Mar 14)
- Re: TTY pushback vulnerabilities / TIOCSTI Jakub Wilk (Mar 14)
- Re: TTY pushback vulnerabilities / TIOCSTI Hanno Böck (Mar 17)
- Re: TTY pushback vulnerabilities / TIOCSTI Jakub Wilk (Mar 17)
- Re: TTY pushback vulnerabilities / TIOCSTI Hanno Böck (Mar 19)
- Re: TTY pushback vulnerabilities / TIOCSTI Jakub Wilk (Mar 21)
- Re: TTY pushback vulnerabilities / TIOCSTI Hanno Böck (Mar 24)
- Re: TTY pushback vulnerabilities / TIOCSTI Hanno Böck (Mar 17)
- Re: TTY pushback vulnerabilities / TIOCSTI Jakub Wilk (Mar 14)
- Re: TTY pushback vulnerabilities / TIOCSTI Lyndon Nerenberg (VE7TFX/VE6BBM) (Mar 18)
- Re: TTY pushback vulnerabilities / TIOCSTI Christos Zoulas (Mar 18)
- Re: TTY pushback vulnerabilities / TIOCSTI Eric Ashley (Mar 18)