Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 31 Jan 2024 23:58:40 +0100
From: Jakub Wilk <>
To: <>
CC: halfdog <>
Subject: Re: TTY handling when executing code in different
 lower-privileged context (su, virt containers)

I'm a few years late, but hey.

* halfdog <>, 2012-11-05 19:22:
>The basic idea is, that a program started from interactive shell can 
>access the TTY and also inject input data using TIOCSTI ioctl.
>In both cases, paranoid administrators might decide to use /dev/null as 

Redirecting unneeded fds is a good idea, but alone it's not sufficient 
to defeat the attack. The unprivileged process could open /dev/tty and 
then issue TIOCSTI on that fd.


This insufficient work-around is also mentioned on the website:

"When no interactive shell is needed in lower-privileged context, su et 
al. can be run with stdin, stdout, stderr redirection, not passing a 
tty-fd to the other context"

Jakub Wilk

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.