From: "Hanno Böck" <hanno@hboeck.de>
To: kernel-hardening@lists.openwall.com
Subject: [PATCH] Restrict access to TIOCLINUX
Date: Sun, 2 Apr 2023 16:08:15 +0200 [thread overview]
Message-ID: <20230402160815.74760f87.hanno@hboeck.de> (raw)
Hi,
I'm sending this here before I'll try to send it to lkml and the
respective maintainers to get some feedback first.
The TIOCLINUX functionality in the kernel can be abused for privilege
escalation, similar to TIOCSTI. I considered a few options how to fix
this, and this is what I came up with.
Restrict access to TIOCLINUX
TIOCLINUX can be used for privilege escalation on virtual terminals when
code is executed via tools like su/sudo.
By abusing the selection features a lower-privileged application can
write content to the console, select and copy/paste that content and
thereby executing code on the privileged account. See also the poc here:
https://www.openwall.com/lists/oss-security/2023/03/14/3
Selection is usually used by tools like gpm that provide mouse features
on the virtual console. gpm already runs as root (due to earlier
changes that restrict access to a user on the current tty), therefore
it will still work with this change.
The security problem mitigated is similar to the security risks caused
by TIOCSTI, which, since kernel 6.2, can be disabled with
CONFIG_LEGACY_TIOCSTI=n.
Signed-off-by: Hanno Böck <hanno@hboeck.de>
---
drivers/tty/vt/vt.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 3c2ea9c098f7..3671173109b8 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -3146,10 +3146,14 @@ int tioclinux(struct tty_struct *tty, unsigned
long arg) switch (type)
{
case TIOCL_SETSEL:
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
ret = set_selection_user((struct
tiocl_selection __user *)(p+1), tty);
break;
case TIOCL_PASTESEL:
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
ret = paste_selection(tty);
break;
case TIOCL_UNBLANKSCREEN:
@@ -3158,6 +3162,8 @@ int tioclinux(struct tty_struct *tty, unsigned
long arg) console_unlock();
break;
case TIOCL_SELLOADLUT:
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
console_lock();
ret = sel_loadlut(p);
console_unlock();
--
2.40.0
--
Hanno Böck
https://hboeck.de/
next reply other threads:[~2023-04-02 14:08 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-02 14:08 Hanno Böck [this message]
2023-04-02 14:55 ` [PATCH] Restrict access to TIOCLINUX Greg KH
2023-04-02 17:16 ` Hanno Böck
2023-04-02 17:23 ` Greg KH
2023-04-02 17:33 ` Hanno Böck
2023-04-02 17:44 ` Greg KH
2023-04-04 21:54 ` Jordan Glover
2023-08-18 16:10 ` Günther Noack
2023-08-22 12:07 ` Greg KH
2023-08-22 12:51 ` Boris Lukashev
2023-08-22 13:34 ` Greg KH
2023-08-22 18:22 ` Günther Noack
2023-08-23 14:36 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230402160815.74760f87.hanno@hboeck.de \
--to=hanno@hboeck.de \
--cc=kernel-hardening@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).