Описание
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| util-linux | fixed | 2.31.1-0.1 | package | |
| util-linux | no-dsa | stretch | package | |
| util-linux | no-dsa | jessie | package | |
| util-linux | not-affected | wheezy | package | |
| util-linux | not-affected | squeeze | package |
Примечания
Restricting ioctl on the kernel side seems the better approach, patches have been posted to kernel-hardening list
https://www.openwall.com/lists/oss-security/2016/02/27/1
https://marc.info/?l=util-linux-ng&m=145694736107128&w=2
2.31 introduces a new --pty option to separate privileged and unprivileged
shells (not enabled by default and the cli switch is necessary).
Связанные уязвимости
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
Уязвимость пакета служебных утилит командной строки util-linux, связанная с недостатками разграничения доступа при аутентификации пользователя, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании