Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution

["Todd C. Miller" <Todd.Miller () sudo ws>]

On Wed, 19 Apr 2023 02:59:26 +0800, Ruihan Li wrote:

> Yeah, I see that you are removing ioctl calls on standard file
> descriptors. So actually, just to confirm, it is feasible to avoid
> all ioctl calls to standard file descriptors with root privileges
> (under all command line arguments), by using /dev/tty, assuming
> something like the window size... Right?

For the most part, yes.  There are still some calls to isatty(3)
using the standard file descriptors when setting up the event loop
to run the program but that is after the user has been verified.
I will add checks that the fd is a character special file before
calling isatty(3).  In most cases the code wants the contents of
struct stat anyway, so the S_ISCHR check is basically free.

> If this is the case, I think it should not be difficult for other
> setuid programs to do similar things.  I am just thinking for a
> while, and cannot find a case where ioctl calls are unavoidable.

If there are setuid programs that call ttyname(3) that will also
call tcgetattr(3).  Also, the glibc getpass(3) function will use
tcgetattr(3) and tcsetattr(3) (to disable echo) on the standard
input if /dev/tty is not available.  For getpass(3) this could be
avoided by only trying to disable echo when using /dev/tty.  That
would change the behavior of things like:

    su < /some/other/tty 

when /dev/tty is unavailable but I don't know what use case that
would actually support.

 - todd