Published: 13/02/2017 Updated: 18/04/2022

CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4

CVSS v3 Base Score: 7.8 | Impact Score: 6 | Exploitability Score: 1.1

VMScore: 392

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freedesktop polkit
redhat enterprise linux 6.0
redhat enterprise linux 7.0

Debian Bug report logs - #812512 policykit-1: CVE-2016-2568: Program run via pkexec as unprivileged user can escape to parent session via TIOCSTI ioctl Package: src:policykit-1; Maintainer for src:policykit-1 is Utopia Maintenance Team <pkg-utopia-maintainers@listsaliothdebianorg>; Reported by: up201407890@alunosdccfcup ...

Debian Bug report logs - #816320 coreutils: CVE-2016-2781: nonpriv session can escape to the parent session by using the TIOCSTI ioctl Package: src:coreutils; Maintainer for src:coreutils is Michael Stone <mstone@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 29 Feb 2016 19:48:01 UTC Se ...

Debian Bug report logs - #850702 CVE-2017-5226 -- bubblewrap escape Package: bubblewrap; Maintainer for bubblewrap is Utopia Maintenance Team <pkg-utopia-maintainers@listsaliothdebianorg>; Source for bubblewrap is src:bubblewrap (PTS, buildd, popcon) Reported by: up201407890@alunosdccfcuppt Date: Mon, 9 Jan 2017 13 ...

Debian Bug report logs - #838599 policycoreutils: CVE-2016-7545: SELinux sandbox escape via TIOCSTI ioctl Package: policycoreutils; Maintainer for policycoreutils is Debian SELinux maintainers <selinux-devel@listsaliothdebianorg>; Source for policycoreutils is src:policycoreutils (PTS, buildd, popcon) Reported by: up20140 ...

Debian Bug report logs - #815922 util-linux: CVE-2016-2779: runuser tty hijacking via TIOCSTI ioctl Package: util-linux; Maintainer for util-linux is LaMont Jones <lamont@debianorg>; Source for util-linux is src:util-linux (PTS, buildd, popcon) Reported by: up201407890@alunosdccfcuppt Date: Thu, 25 Feb 2016 18:54:02 U ...

It was found that pkexec was vulnerable to TIOCSTI ioctl attacks, allowing the executed program to push characters to its TTY's input buffer While being executed as a non-privileged user, a specially crafted program could force its parent TTY to enter commands, interpreted by the shell when pkexec exits ...

CWE-116 https://bugzilla.redhat.com/show_bug.cgi?id=1300746 http://www.openwall.com/lists/oss-security/2016/02/26/3 https://ubuntu.com/security/CVE-2016-2568 https://access.redhat.com/security/cve/cve-2016-2568 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816062 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=812512 https://access.redhat.com/security/cve/cve-2016-2568

CVE-2016-2568

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect