openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticate_user() relies on stat(/proc/<pid>/fd/0). stat() on /proc/<pid>/fd/0 follows the symlink to the underlying TTY device node. As a result, buf.st_uid reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to root or the getty owner after logout while an unprivileged process still has fd 0 attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the -u path executes a passwordless login as the selected user. In the documented kbrequest/init deployment using openvt -us, this can result in passwordless login -f root on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use openvt -u from a privileged kbrequest/init path.
Weakness
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Hardened Images | RedHat | kbd-main-2.10.0-2.hum1 | * |
Extended Description
Access control involves the use of several protection mechanisms such as:
When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. There are two distinct behaviors that can introduce access control weaknesses:
Potential Mitigations
- Compartmentalize the system to have “safe” areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/19.html
- https://cwe.mitre.org/data/definitions/441.html
- https://cwe.mitre.org/data/definitions/478.html
- https://cwe.mitre.org/data/definitions/479.html
- https://cwe.mitre.org/data/definitions/502.html
- https://cwe.mitre.org/data/definitions/503.html
- https://cwe.mitre.org/data/definitions/536.html
- https://cwe.mitre.org/data/definitions/546.html
- https://cwe.mitre.org/data/definitions/550.html
- https://cwe.mitre.org/data/definitions/551.html
- https://cwe.mitre.org/data/definitions/552.html
- https://cwe.mitre.org/data/definitions/556.html
- https://cwe.mitre.org/data/definitions/558.html
- https://cwe.mitre.org/data/definitions/562.html
- https://cwe.mitre.org/data/definitions/563.html
- https://cwe.mitre.org/data/definitions/564.html
- https://cwe.mitre.org/data/definitions/578.html