On Tue, 7 Apr 2026 20:09:06 -0400 Aaron Rainbolt <[email protected]> wrote:
> Going over this semi-briefly: > > * systemd-journald is configured with the `ForwardToWall=yes` and > `MaxWallLevel=emerg` settings by default in Ubuntu 26.04 pre-release > images and Arch Linux. (I think this is because these are enabled by > default in systemd upstream but haven't tried to verify this.) In my > testing, this will result in systemd-journald copying emerg-level > log messages to all logged-in TTYs and at least some root-owned PTYs > (if any exist). > * Any user on the system can write an emerg-level log message using > `logger -p emerg 'msg...'`. > * Potentially dangerous character sequences in log messages (like ANSI > escape sequences) are not sanitized by systemd-journald before it > prints those messages to other user's terminals. > * Therefore, one can use systemd-journald to write malicious things to > other people's terminals, which can be used to exploit terminal > emulator vulnerabilities. There have been vulnerabilities in > terminal emulators like XTerm in the past that would allow this to > be used to execute arbitrary code as root if someone is unlucky > enough to have a PTY to a root shell open in a vulnerable terminal > when an attacker writes their malicious log message. Someone (not sure who) did the kind service of getting a CVE assigned for this: https://www.cve.org/CVERecord?id=CVE-2026-40228 To whoever that was, thank you :) -- Aaron
pgpCAbNv95K8x.pgp
Description: OpenPGP digital signature
