kernel-hardening - Re: [PATCH v2 1/1] tty: Restrict access to TIOCLINUX' copy-and-paste subcommands

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 28 Aug 2023 16:48:28 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Günther Noack <gnoack@...gle.com>
Cc: Hanno Böck <hanno@...eck.de>,
	kernel-hardening@...ts.openwall.com,
	Kees Cook <keescook@...omium.org>,
	Jiri Slaby <jirislaby@...nel.org>,
	Geert Uytterhoeven <geert@...ux-m68k.org>,
	Paul Moore <paul@...l-moore.com>,
	Samuel Thibault <samuel.thibault@...-lyon.org>,
	David Laight <David.Laight@...lab.com>,
	Simon Brand <simon.brand@...tadigitale.de>,
	Dave Mielke <Dave@...lke.cc>,
	Mickaël Salaün <mic@...ikod.net>,
	KP Singh <kpsingh@...gle.com>,
	Nico Schottelius <nico-gpm2008@...ottelius.org>
Subject: Re: [PATCH v2 1/1] tty: Restrict access to TIOCLINUX' copy-and-paste
 subcommands

On Mon, Aug 28, 2023 at 02:21:09PM +0200, Günther Noack wrote:
> From: Hanno Böck <hanno@...eck.de>
> 
> TIOCLINUX can be used for privilege escalation on virtual terminals when
> code is executed via tools like su/sudo and sandboxing tools.
> 
> By abusing the selection features, a lower-privileged application can
> write content to the console, select and copy/paste that content and
> thereby executing code on the privileged account. See also the poc
> here:
> 
>   https://www.openwall.com/lists/oss-security/2023/03/14/3
> 
> Selection is usually used by tools like gpm that provide mouse features
> on the virtual console. gpm already runs as root (due to earlier
> changes that restrict access to a user on the current TTY), therefore
> it will still work with this change.
> 
> With this change, the following TIOCLINUX subcommands require
> CAP_SYS_ADMIN:
> 
>  * TIOCL_SETSEL - setting the selected region on the terminal
>  * TIOCL_PASTESEL - pasting the contents of the selected region into
>    the input buffer
>  * TIOCL_SELLOADLUT - changing word-by-word selection behaviour
> 
> The security problem mitigated is similar to the security risks caused
> by TIOCSTI, which, since kernel 6.2, can be disabled with
> CONFIG_LEGACY_TIOCSTI=n.
> 
> Signed-off-by: Hanno Böck <hanno@...eck.de>
> Tested-by: Günther Noack <gnoack@...gle.com>

When you pass on a patch like this, you too need to sign off on it as
per the instructions in the DCO.  I'm pretty sure the Google open source
training also says that, but maybe not.  If not, it should :)

thanks,

greg k-h

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.