coreutils: CVE-2016-2781: nonpriv session can escape to the parent session by using the TIOCSTI ioctl

Debian Bug report logs - #816320
coreutils: CVE-2016-2781: nonpriv session can escape to the parent session by using the TIOCSTI ioctl

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: coreutils: CVE-2016-2781: nonpriv session can escape to the parent session by using the TIOCSTI ioctl

Date: Mon, 29 Feb 2016 20:44:55 +0100

Source: coreutils
Version: 8.13-1
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for coreutils.

CVE-2016-2781[0]:
|nonpriv session can escape to the parent session by using the TIOCSTI
| ioctl

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-2781
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1312863
[2] http://seclists.org/oss-sec/2016/q1/452

Regards,
Salvatore

Message #10 received at 816320@bugs.debian.org (full text, mbox, reply):

From: Petter Reinholdtsen <pere@hungry.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 816320@bugs.debian.org

Subject: Re: coreutils: CVE-2016-2781: nonpriv session can escape to the parent session by using the TIOCSTI ioctl

Date: Fri, 24 Jun 2016 11:23:37 +0200

[Salvatore Bonaccorso]
> the following vulnerability was published for coreutils.
> 
> CVE-2016-2781[0]:
> |nonpriv session can escape to the parent session by using the TIOCSTI
> | ioctl

This seem to be a similar issue to 
<URL: https://security-tracker.debian.org/tracker/CVE-2016-2568 > in pkexec,
which in its bug report #812512 mention a similar issue in su (CVE-2005-4890)
solved using setsid() and in sudo solved using the "use_pty" flag.  Perhaps one
of these techniques might be usable here too?

I also found <URL: https://cxsecurity.com/issue/WLB-2012110063 > going into
details regarding su and vserver being hit by a similar problem.
-- 
Happy hacking
Petter Reinholdtsen

Send a report that this bug log contains spam.