4 ms·
Do you use doas on Linux? It is not protected against tty pushback attack: https://github.com/Duncaen/OpenDoas/issues/106 https://github.com/Duncaen/OpenDoas/is
by hannob 3y ago
Do you use doas on Linux? It is not protected against tty pushback attack:
https://github.com/Duncaen/OpenDoas/issues/106 https://github.com/Duncaen/OpenDoas/issues/106
That's a pretty severe unsolved security issue.
- zokier 3y agoIt's solved; TIOCSTI is disabled by default since Linux 6.2 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=83efeeeb3d04b22aaed1df99bc70a48fe9d22c4d https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
- hannob 3y agoThe thing you linked says "default y" to "Allow legacy TIOCSTI usage". So yeah, you can disable it, no, it's not the default. There's also a related issue with TIOCLINUX and the paste functionality. (That will however be solved in an upcoming kernel version. I wrote the patch for it :-)
- csdvrx 3y ago> There's also a related issue with TIOCLINUX and the paste functionality. (That will however be solved in an upcoming kernel version. I wrote the patch for it :-) If anyone wants to apply that to their kernel, it's on https://lore.kernel.org/all/2023101158-esteemed-condiment-1dd6@gregkh/T/ https://lore.kernel.org/all/2023101158-esteemed-condiment-1d...