Linux-kernel mailing list archive 1997-48,: REPOST: Security Bug in Virtual Terminal Driver (vt.c)

# REPOST: Security Bug in Virtual Terminal Driver (vt.c)

Stefan Reinauer (stepan@freiburg.linux.de)
Tue, 2 Dec 1997 17:47:51 +0100

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Alan Cox: "Re: IP Masquerading latest 2.1.x"
- Previous message: Alan Cox: "Re: [k]nfsd, nfs and security questions"

Hi again,..

Imagine the following: A user changes the key mapping of the Linux
console
completely using loadkeys. He putīs some "echo "blabla" >/etc/passwd" on
any often used key. After that root logs in on the console and hits that
key. What happens? Exactly. Root has to deal with that exploited keymap.
It doesnīt matter which one of the virtual consoles she uses because
Linux
uses a shared keymap buffer for all these consoles.

But why should any user change the keyboard mapping at all? isnīt that a
point of system administration?

The following patch fixes this problem for 2.1.69. It disables
changing the keyboard mapping as a user.

Please tell me your opinions about that...

Stefan

--- vt.c.old Tue Dec 2 12:48:14 1997
+++ vt.c Tue Dec 2 12:49:10 1997
@@ -220,7 +220,7 @@
val = (i ? K_HOLE : K_NOSUCHMAP);
return __put_user(val, &user_kbe->kb_value);
case KDSKBENT:
- if (!perm)
+ if (!suser())
return -EPERM;
if (!i && v == K_NOSUCHMAP) {
/* disallocate map */

- Next message: Alan Cox: "Re: IP Masquerading latest 2.1.x"
- Previous message: Alan Cox: "Re: [k]nfsd, nfs and security questions"