Re: Keymapping vunerability (drivers/char/vt.c)

From: Alan Cox (alan@lxorguk.ukuu.org.uk)
Date: Thu Jun 15 2000 - 11:18:10 EST


> Nefarius person gains access to a tty (can't be telnet, must
> be a bona fide tty) and type the following
>
> theseus:~$ loadkeys
> string F55 = "\nfoobar\n"
> keycode 69 = F55
> theseus:~$
>
> Then, a legitimate user logs into the system, and when that

You mean you dont restore the keyboard map in your getty ?

> case KDGETKEYCODE:
> case KDSETKEYCODE:
> - return do_kbkeycode_ioctl(cmd, (struct kbkeycode *)arg, perm);
> + if (!suser()) /* Added superuser checks to avoid naughty people */

Why are you stopping non root users retrieving maps

Alan

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Thu Jun 15 2000 - 21:00:35 EST