Re: TTY pushback vulnerabilities / TIOCSTI

[Fabian Keil <freebsd-listen () fabiankeil de>]

Shawn Webb <shawn.webb () hardenedbsd org> wrote on 2023-03-14 at 16:57:25:

> On Tue, Mar 14, 2023 at 09:51:03AM +0100, Hanno Böck wrote:
> > Hi,
> >
> > This blogpost highlights TTY Pushback vulnerabilities enabled via the
> > TIOCSTI kernel functionality available in the Linux kernel:
> > https://www.errno.fr/TTYPushback.html
> >
> > This has been discussed here previously:
> > https://www.openwall.com/lists/oss-security/2017/06/03/9
> >
> > Though I think there are some noteworthy updates. In the 2017 post
> > solar designer mentioned that the Linux kernel developers have multiple
> > times rejected changes in the kernel. However this has now changed:
> > Starting with Kernel 6.2 it is possible to disable TIOCSTI
> > (unset CONFIG_LEGACY_TIOCSTI). It also appears that very few (or no?)
> > applications practically use TIOCSTI.
> >
> > This seems to be the only real mitigation for this issue. It appears
> > su has a parameter, and in sudo one can configure the creation of a new
> > pty in the sudoers file. I don't consider these as satisfying fixes, as
> > they are optinal, and thus rely on the expectation that users are aware
> > of this risk and manually use these mitigations. That does not seem
> > realistic to me.
> >
> > This also affects such a large number of tools, not just
> > su/sudo-like tools, but also sandboxing tools. E.g. bubblewrap [1] is
> > affected by this by default.
> >
> > Thus I strongly recommend that people disable this in the kernel.
> >
> > [1] https://github.com/containers/bubblewrap/issues/555
>
> With commit c7d6d4bb4874720d9dab1625df62c2ea6eeb9df5[0], I've added a
> toggle in HardenedBSD to disable TIOCSTI. The toggle is set to
> prohibit TIOCSTI by default. Now attempts to use TIOCSTI will be met
> with EPERM.

In ElectroBSD I removed TIOCSTI support in 2017 [0] and haven't
noticed any problems.

According to the commit message "TIOCSTI is still used in tcsh,
but as tcsh isn't compiled on ElectroBSD we don't care".

> I've verified the toggle in a real-world scenario with the doas issue
> PoC found at [1].

I should probably do the same.

Fabian

[0]: 
<https://www.fabiankeil.de/sourcecode/electrobsd/ElectroBSD-20220822-d9391cfeef5b/0157-sys-kern-Follow-OpenBSD-s-lead-and-remove-TIOCSTI-sup.diff>

Attachment: _bin
Description: OpenPGP digital signature