[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20260504194400.76c91ed7@riseup.net>
Date: Mon, 4 May 2026 19:44:47 -0400
From: Aaron Rainbolt <arraybolt3@...eup.net>
To: oss-security@...ts.openwall.com
Cc: adrelanos@...nix.org, arraybolt3@...il.com
Subject: Re: systemd-journald in systemd 259 does not escape characters in
emerg messages that are wall'd to other user's terminals
On Tue, 7 Apr 2026 20:09:06 -0400
Aaron Rainbolt <arraybolt3@...eup.net> wrote:
> Going over this semi-briefly:
>
> * systemd-journald is configured with the `ForwardToWall=yes` and
> `MaxWallLevel=emerg` settings by default in Ubuntu 26.04 pre-release
> images and Arch Linux. (I think this is because these are enabled by
> default in systemd upstream but haven't tried to verify this.) In my
> testing, this will result in systemd-journald copying emerg-level
> log messages to all logged-in TTYs and at least some root-owned PTYs
> (if any exist).
> * Any user on the system can write an emerg-level log message using
> `logger -p emerg 'msg...'`.
> * Potentially dangerous character sequences in log messages (like ANSI
> escape sequences) are not sanitized by systemd-journald before it
> prints those messages to other user's terminals.
> * Therefore, one can use systemd-journald to write malicious things to
> other people's terminals, which can be used to exploit terminal
> emulator vulnerabilities. There have been vulnerabilities in
> terminal emulators like XTerm in the past that would allow this to
> be used to execute arbitrary code as root if someone is unlucky
> enough to have a PTY to a root shell open in a vulnerable terminal
> when an attacker writes their malicious log message.
Someone (not sure who) did the kind service of getting a CVE assigned
for this: https://www.cve.org/CVERecord?id=CVE-2026-40228 To whoever
that was, thank you :)
--
Aaron
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
