oss-sec mailing list archives
Re: virtual consoles
From: Tavis Ormandy <taviso () gmail com>
Date: Mon, 2 Dec 2019 09:39:32 -0800
On Mon, Dec 02, 2019 at 06:28:12PM +0100, Solar Designer wrote:
On Mon, Dec 02, 2019 at 08:56:38AM -0800, Tavis Ormandy wrote:Regardless of your position, this is certainly possible on desktop Linux too, unprivileged users can start a new X server and switch virtual console, even over ssh. e.g. $ dbus-send --system --print-reply --dest=org.freedesktop.login1 /org/freedesktop/login1/seat/seat0 org.freedesktop.login1.Seat.SwitchTo uint32:2 (note: object paths may vary by distro, change the 2 to a different number if you're already on VT2, or seat0 if you're on a different seat)If this in fact works over SSH and from a user account different than the one logged in on the currently active virtual console, then I'd say it's a vulnerability on its own, regardless of the social engineering aspects you mention.
Definitely does on Fedora and Ubuntu, an entirely remote unprivileged user can use it, even if root is logged in at the virtual console. It's very simple to switch to an X server displaying a fake screensaver while the user is sitting there.
Why does this functionality even exist?Should this have some policykit action requirement, or require physical presence? I don't know the answer.Maybe simply drop the misfeature? Alexander
That would make things simpler! I can't think of any reason this would ever be useful. Tavis -- ------------------------------------- taviso () sdf lonestar org | finger me for my pgp key. -------------------------------------------------------
Current thread:
- virtual consoles Tavis Ormandy (Dec 02)
- Re: virtual consoles Solar Designer (Dec 02)
- Re: virtual consoles Tavis Ormandy (Dec 02)
- Re: virtual consoles Leonid Isaev (Dec 02)
- Re: virtual consoles Leonid Isaev (Dec 02)
- Re: virtual consoles Georgi Guninski (Dec 03)
- Re: virtual consoles Simon McVittie (Dec 03)
- Re: virtual consoles Tavis Ormandy (Dec 03)
- Re: virtual consoles Solar Designer (Dec 02)