3 ms·
PaX/grsecurity has mitigation to this issue, at least for 10 years. From grsecurity's config for GRKERNSEC_HARDEN_TTY. | There are very few legitimate use
by bcaa7f3a8bbc 8y ago
PaX/grsecurity has mitigation to this issue, at least for 10 years.
From grsecurity's config for GRKERNSEC_HARDEN_TTY.
| There are very few legitimate uses for this functionality and it
| has made vulnerabilities in several 'su'-like programs possible in
| the past. Even without these vulnerabilities, it provides an
| attacker with an easy mechanism to move laterally among other
| processes within the same user's compromised session.
Has one run a grsecurity kernel, the system would not be affected.
Some independent developers and KSPP people are also trying to submit this mitigation to the mainline kernel for many years, but so far none of the patch went into the kernel. Since grsecurity is now a private product, you may want to check them out and apply this mitigation to the mainline kernel.
[PATCH] drivers/tty: add protected_ttys sysctl
* https://gist.github.com/thejh/e163071dfe4c96a9f9b589b7a2c24fc6 https://gist.github.com/thejh/e163071dfe4c96a9f9b589b7a2c24f...
tiocsti-restrict : make TIOCSTI ioctl require CAP_SYS_ADMIN
* https://lwn.net/Articles/720740/ https://lwn.net/Articles/720740/