Fix CVE-2026-72693: openvt -u process matching made more conservative
Backport upstream commit 78d5ae119742e87baa7dbe0f5c4107e7533fd698
to fix CVE-2026-72693 in openvt's -u option. The patch makes VT
owner process matching stricter by reading /proc/pid/stat for
tty matching instead of relying on inherited file descriptor
ownership, adds root rejection for pre-authentication, and
filters /proc entries to digits only. The man page is updated
to document the tighter -u behavior.
CVE: CVE-2026-72693
Upstream patches:
- 78d5ae1197.patch
Resolves: RHEL-235987
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
5c34fceb7c
commit
7ba08a9eff
148
kbd-2.6.4-CVE-2026-72693.patch
Normal file
148
kbd-2.6.4-CVE-2026-72693.patch
Normal file
@ -0,0 +1,148 @@
|
||||
From c347290a8775bfbc627309db772ef13489f62207 Mon Sep 17 00:00:00 2001
|
||||
From: Alexey Gladkov <legion@kernel.org>
|
||||
Date: Tue, 12 May 2026 10:20:50 +0200
|
||||
Subject: [PATCH] openvt: make -u process matching more conservative
|
||||
|
||||
The -u mode relies on the current VT owner to decide which user should
|
||||
be used for the new login session. Make that check stricter by requiring
|
||||
a matching process owner and controlling terminal instead of relying on
|
||||
the ownership of an inherited file descriptor.
|
||||
|
||||
Also reject root as a pre-authenticated target and document the tighter
|
||||
behavior in the man page.
|
||||
|
||||
Signed-off-by: Alexey Gladkov <legion@kernel.org>
|
||||
---
|
||||
docs/man/man1/openvt.1 | 10 +++++++
|
||||
src/openvt.c | 64 +++++++++++++++++++++++++++++++++++++-----
|
||||
2 files changed, 67 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/docs/man/man1/openvt.1 b/docs/man/man1/openvt.1
|
||||
index 79bfe3f..074de96 100644
|
||||
--- a/docs/man/man1/openvt.1
|
||||
+++ b/docs/man/man1/openvt.1
|
||||
@@ -36,6 +36,8 @@ will be made the new current VT.
|
||||
.I "\-u, \-\-user"
|
||||
Figure out the owner of the current VT, and run login as that user.
|
||||
Suitable to be called by init. Shouldn't be used with \fI\-c\fR or \fI\-l\fR.
|
||||
+This option refuses to pre-authenticate root and requires a process owned by
|
||||
+the VT owner whose controlling terminal is the current VT.
|
||||
.TP
|
||||
.I "\-l, \-\-login"
|
||||
Make the command a login shell. A \- is prepended to the name of the command
|
||||
@@ -64,6 +66,14 @@ If
|
||||
is compiled with a getopt_long() and you wish to set
|
||||
options to the command to be run, then you must supply
|
||||
the end of options \-\- flag before the command.
|
||||
+.PP
|
||||
+The
|
||||
+.B \-u
|
||||
+option uses
|
||||
+.BR "login -f"
|
||||
+and therefore bypasses normal password authentication for the detected user.
|
||||
+It is intended only for controlled init or keyboard-request configurations.
|
||||
+Use a normal authenticated login command when authentication is required.
|
||||
.SH EXAMPLES
|
||||
.B openvt
|
||||
can be used to start a shell on the next free VT, by using the command:
|
||||
diff --git a/src/openvt.c b/src/openvt.c
|
||||
index 5980361..b8436fe 100644
|
||||
--- a/src/openvt.c
|
||||
+++ b/src/openvt.c
|
||||
@@ -78,6 +78,51 @@ usage(int rc, const struct kbd_help *options)
|
||||
exit(rc);
|
||||
}
|
||||
|
||||
+static int
|
||||
+proc_pid_stat(const char *pid, uid_t *uid, dev_t *tty)
|
||||
+{
|
||||
+ char filename[NAME_MAX + 12];
|
||||
+ char line[BUFSIZ];
|
||||
+ char *lp, *rp;
|
||||
+ FILE *fp;
|
||||
+ struct stat st;
|
||||
+ long tty_nr;
|
||||
+
|
||||
+ snprintf(filename, sizeof(filename), "/proc/%s/stat", pid);
|
||||
+ fp = fopen(filename, "r");
|
||||
+ if (!fp)
|
||||
+ return -1;
|
||||
+
|
||||
+ if (fstat(fileno(fp), &st)) {
|
||||
+ fclose(fp);
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
+ if (!fgets(line, sizeof(line), fp)) {
|
||||
+ fclose(fp);
|
||||
+ return -1;
|
||||
+ }
|
||||
+ fclose(fp);
|
||||
+
|
||||
+ rp = strrchr(line, ')');
|
||||
+ if (!rp)
|
||||
+ return -1;
|
||||
+
|
||||
+ /*
|
||||
+ * /proc/<pid>/stat fields after comm are:
|
||||
+ * state ppid pgrp session tty_nr ...
|
||||
+ */
|
||||
+ if (!rp || sscanf(rp + 1, " %*c %*d %*d %*d %ld", &tty_nr) != 1)
|
||||
+ return -1;
|
||||
+
|
||||
+ if (tty_nr <= 0)
|
||||
+ return -1;
|
||||
+
|
||||
+ *uid = st.st_uid;
|
||||
+ *tty = (dev_t) tty_nr;
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
/*
|
||||
* Support for Spawn_Console: openvt running from init
|
||||
* added by Joshua Spoerri, Thu Jul 18 21:13:16 EDT 1996
|
||||
@@ -109,8 +154,7 @@ authenticate_user(int curvt)
|
||||
DIR *dp;
|
||||
struct dirent *dentp;
|
||||
struct stat buf;
|
||||
- dev_t console_dev;
|
||||
- ino_t console_ino;
|
||||
+ dev_t console_rdev;
|
||||
uid_t console_uid;
|
||||
char filename[NAME_MAX + 12];
|
||||
struct passwd *pwnam;
|
||||
@@ -130,10 +174,12 @@ authenticate_user(int curvt)
|
||||
kbd_error(EXIT_FAILURE, errsv, "%s", filename);
|
||||
}
|
||||
}
|
||||
- console_dev = buf.st_dev;
|
||||
- console_ino = buf.st_ino;
|
||||
+ console_rdev = buf.st_rdev;
|
||||
console_uid = buf.st_uid;
|
||||
|
||||
+ if (console_uid == 0)
|
||||
+ kbd_error(EXIT_FAILURE, 0, _("Refusing to pre-authenticate root on current tty."));
|
||||
+
|
||||
/* get the owner of current tty */
|
||||
if (!(pwnam = getpwuid(console_uid)))
|
||||
kbd_error(EXIT_FAILURE, errno, "getpwuid");
|
||||
@@ -141,12 +187,16 @@ authenticate_user(int curvt)
|
||||
/* check to make sure that user has a process on that tty */
|
||||
/* this will fail for example when X is running on the tty */
|
||||
while ((dentp = readdir(dp))) {
|
||||
- sprintf(filename, "/proc/%s/fd/0", dentp->d_name);
|
||||
+ uid_t proc_uid;
|
||||
+ dev_t proc_tty;
|
||||
+
|
||||
+ if (dentp->d_name[0] < '0' || dentp->d_name[0] > '9')
|
||||
+ continue;
|
||||
|
||||
- if (stat(filename, &buf))
|
||||
+ if (proc_pid_stat(dentp->d_name, &proc_uid, &proc_tty) < 0)
|
||||
continue;
|
||||
|
||||
- if (buf.st_dev == console_dev && buf.st_ino == console_ino && buf.st_uid == console_uid)
|
||||
+ if (proc_uid == console_uid && proc_tty == console_rdev)
|
||||
goto got_a_process;
|
||||
}
|
||||
|
||||
9
kbd.spec
9
kbd.spec
@ -5,7 +5,7 @@
|
||||
|
||||
Name: kbd
|
||||
Version: 2.6.4
|
||||
Release: 7%{?dist}
|
||||
Release: 8%{?dist}
|
||||
Summary: Tools for configuring the console (keyboard, virtual terminals, etc.)
|
||||
License: GPL-2.0-or-later
|
||||
URL: http://www.kbd-project.org/
|
||||
@ -37,6 +37,9 @@ Patch7: kbd-2.6.4-initialize-variable.patch
|
||||
# Patch8: adds vlock option to issue prompt before invocation of pam stack
|
||||
# RHEL-RHEL-57035
|
||||
Patch8: kbd-2.0.4-vlock-add-prompt-option.patch
|
||||
# CVE-2026-72693
|
||||
# https://github.com/legionus/kbd/commit/78d5ae119742e87baa7dbe0f5c4107e7533fd698
|
||||
Patch9: kbd-2.6.4-CVE-2026-72693.patch
|
||||
|
||||
BuildRequires: gcc, bison, flex, gettext, pam-devel, check-devel, automake
|
||||
BuildRequires: console-setup, xkeyboard-config
|
||||
@ -188,6 +191,10 @@ make check
|
||||
%{kbd_datadir}/keymaps/legacy
|
||||
|
||||
%changelog
|
||||
* Tue Aug 11 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.6.4-8
|
||||
- Fix openvt -u process matching to be more conservative (CVE-2026-72693)
|
||||
Resolves: RHEL-235987
|
||||
|
||||
* Fri Jan 10 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.4-7
|
||||
- Add vlock option to issue prompt before invocation of pam stack
|
||||
Resolves: RHEL-57035
|
||||
|
||||
Loading…
Reference in New Issue
Block a user