tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

tty: Restrict access to TIOCLINUX' copy-and-paste subcommands

TIOCLINUX can be used for privilege escalation on virtual terminals when
code is executed via tools like su/sudo and sandboxing tools.

By abusing the selection features, a lower-privileged application can
write content to the console, select and copy/paste that content and
thereby executing code on the privileged account. See also the poc
here:

https://www.openwall.com/lists/oss-security/2023/03/14/3

Selection is usually used by tools like gpm that provide mouse features
on the virtual console. gpm already runs as root (due to earlier
changes that restrict access to a user on the current TTY), therefore
it will still work with this change.

With this change, the following TIOCLINUX subcommands require
CAP_SYS_ADMIN:

* TIOCL_SETSEL - setting the selected region on the terminal
* TIOCL_PASTESEL - pasting the contents of the selected region into
the input buffer
* TIOCL_SELLOADLUT - changing word-by-word selection behaviour

The security problem mitigated is similar to the security risks caused
by TIOCSTI, which, since kernel 6.2, can be disabled with
CONFIG_LEGACY_TIOCSTI=n.

Signed-off-by: Hanno Böck <hanno@hboeck.de>
Signed-off-by: Günther Noack <gnoack@google.com>
Tested-by: Günther Noack <gnoack@google.com>
Link: https://lore.kernel.org/r/20230828164117.3608812-2-gnoack@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Hanno Böck and committed by
Greg Kroah-Hartman 8d1b43f6 7cda0b9e

+6
+6
drivers/tty/vt/vt.c
··· 3155 3155 3156 3156 switch (type) { 3157 3157 case TIOCL_SETSEL: 3158 + if (!capable(CAP_SYS_ADMIN)) 3159 + return -EPERM; 3158 3160 return set_selection_user((struct tiocl_selection 3159 3161 __user *)(p+1), tty); 3160 3162 case TIOCL_PASTESEL: 3163 + if (!capable(CAP_SYS_ADMIN)) 3164 + return -EPERM; 3161 3165 return paste_selection(tty); 3162 3166 case TIOCL_UNBLANKSCREEN: 3163 3167 console_lock(); ··· 3169 3165 console_unlock(); 3170 3166 break; 3171 3167 case TIOCL_SELLOADLUT: 3168 + if (!capable(CAP_SYS_ADMIN)) 3169 + return -EPERM; 3172 3170 console_lock(); 3173 3171 ret = sel_loadlut(p); 3174 3172 console_unlock();