4 ms·
This is old news, that keeps being reported over and over. Part of the problem, I suspect, is that people keep pointing to the wrong locus of the problem. Eve
by JdeBP 8y ago
This is old news, that keeps being reported over and over. Part of the problem, I suspect, is that people keep pointing to the wrong locus of the problem. Even here, this is being characterized as a Debian problem.
This is a kernel mechanism.
* https://nvd.nist.gov/vuln/detail/CVE-2013-6409 https://nvd.nist.gov/vuln/detail/CVE-2013-6409
* https://nvd.nist.gov/vuln/detail/CVE-2015-6565 https://nvd.nist.gov/vuln/detail/CVE-2015-6565
* https://nvd.nist.gov/vuln/detail/CVE-2016-2779 https://nvd.nist.gov/vuln/detail/CVE-2016-2779
* https://nvd.nist.gov/vuln/detail/CVE-2016-7545 https://nvd.nist.gov/vuln/detail/CVE-2016-7545
* https://nvd.nist.gov/vuln/detail/CVE-2017-5226 https://nvd.nist.gov/vuln/detail/CVE-2017-5226
Some kernel people take the view that TIOCSTI is of no Earthly use, and there are other ways to implement line editing, and just make using it an error.
* http://undeadly.org/cgi?action=article&sid=20170701132619 http://undeadly.org/cgi?action=article&sid=20170701132619
* https://github.com/openbsd/src/commit/baecf150995d4609cd147948779361c3152f355d https://github.com/openbsd/src/commit/baecf150995d4609cd1479...
Others take a different view.
* http://www.openwall.com/lists/oss-security/2017/06/03/9 http://www.openwall.com/lists/oss-security/2017/06/03/9
* http://www.openwall.com/lists/kernel-hardening/2017/05/15/8 http://www.openwall.com/lists/kernel-hardening/2017/05/15/8
* http://www.openwall.com/lists/kernel-hardening/2017/05/17/1 http://www.openwall.com/lists/kernel-hardening/2017/05/17/1
* http://www.openwall.com/lists/kernel-hardening/2017/05/29/16 http://www.openwall.com/lists/kernel-hardening/2017/05/29/16
* http://www.openwall.com/lists/kernel-hardening/2017/05/30/9 http://www.openwall.com/lists/kernel-hardening/2017/05/30/9
* http://www.openwall.com/lists/kernel-hardening/2017/05/30/26 http://www.openwall.com/lists/kernel-hardening/2017/05/30/26
* http://www.openwall.com/lists/kernel-hardening/2017/05/30/27 http://www.openwall.com/lists/kernel-hardening/2017/05/30/27
* http://www.openwall.com/lists/kernel-hardening/2017/05/30/32 http://www.openwall.com/lists/kernel-hardening/2017/05/30/32
* http://www.openwall.com/lists/kernel-hardening/2017/05/31/16 http://www.openwall.com/lists/kernel-hardening/2017/05/31/16
- AbacusAvenger 8y agoUsually when something is reported as being a distribution bug, it's because they have some patch specific to their packages that causes the issue. Is that not the case here? Are other distrbutions affected right now?
- jwilk 8y agoDebian uses su implementation from the shadow package: https://github.com/shadow-maint/shadow https://github.com/shadow-maint/shadow I suspect most other distros use the one from util-linux.
- JdeBP 8y agoI say it again: This is a kernel mechanism. Every operating system based upon Linux provides programs with this mechanism. This is not some ioctl() introduced by a Debian patch. This is a mechanism added to Linux by Linus Torvalds on 1993-12-23. * http://repo.or.cz/davej-history.git/commitdiff/9d0948641495169728d4074f976fd655e30afedf http://repo.or.cz/davej-history.git/commitdiff/9d09486414951... Pete French added it to FreeBSD against his better judgement on 2010-01-04. It might have been in an earlier implementation of the terminal line discipline, too. * https://github.com/freebsd/freebsd/commit/74b0526bbe6326adb72e26dabfe79ab1fe00ca4b https://github.com/freebsd/freebsd/commit/74b0526bbe6326adb7... OpenBSD, which no longer implements the kernel mechanism, had had it since the initial import from NetBSD in 1995. * https://github.com/openbsd/src/blob/df930be708d50e9715f173caa26ffe1b7599b157/sys/kern/tty.c#L847 https://github.com/openbsd/src/blob/df930be708d50e9715f173ca... Illumos has it, and has had since at least the OpenSolaris launch. * https://github.com/illumos/illumos-gate/blob/9a2c4685271c2f0cb4b08f4cc1192387e67af3f9/usr/src/uts/common/io/tty_common.c#L263 https://github.com/illumos/illumos-gate/blob/9a2c4685271c2f0... It was even in 4.3BSD.