Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Mar 2023 09:51:03 +0100
From: Hanno Böck <>
Subject: TTY pushback vulnerabilities / TIOCSTI


This blogpost highlights TTY Pushback vulnerabilities enabled via the
TIOCSTI kernel functionality available in the Linux kernel:

This has been discussed here previously:

Though I think there are some noteworthy updates. In the 2017 post
solar designer mentioned that the Linux kernel developers have multiple
times rejected changes in the kernel. However this has now changed:
Starting with Kernel 6.2 it is possible to disable TIOCSTI
(unset CONFIG_LEGACY_TIOCSTI). It also appears that very few (or no?)
applications practically use TIOCSTI.

This seems to be the only real mitigation for this issue. It appears
su has a parameter, and in sudo one can configure the creation of a new
pty in the sudoers file. I don't consider these as satisfying fixes, as
they are optinal, and thus rely on the expectation that users are aware
of this risk and manually use these mitigations. That does not seem
realistic to me.

This also affects such a large number of tools, not just
su/sudo-like tools, but also sandboxing tools. E.g. bubblewrap [1] is
affected by this by default.

Thus I strongly recommend that people disable this in the kernel.


Hanno Böck

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.