Описание
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
It was found that runuser was vulnerable to TIOCSTI ioctl attacks, allowing the executed program to push characters to its TTY's input buffer. While being executed as a non-privileged user, a specially crafted program could force its parent TTY to enter commands, interpreted by the shell when runuser exits.
Отчет
This issue affects the versions of util-linux as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | util-linux | Not affected | ||
| Red Hat Enterprise Linux 6 | util-linux-ng | Not affected | ||
| Red Hat Enterprise Linux 7 | util-linux | Will not fix | ||
| Red Hat Enterprise Linux 8 | util-linux | Not affected |
Показывать по
Дополнительная информация
Статус:
8.6 High
CVSS3
6.2 Medium
CVSS2
Связанные уязвимости
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
runuser in util-linux allows local users to escape to the parent sessi ...
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
Уязвимость пакета служебных утилит командной строки util-linux, связанная с недостатками разграничения доступа при аутентификации пользователя, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
8.6 High
CVSS3
6.2 Medium
CVSS2