Re: [vserver] Security issue: guest to host escape via TIOCSTI ioctl in vserver enter

From: Herbert Poetzl <>
Date: Sat 10 Nov 2012 - 18:46:55 GMT
Message-ID: <>

On Sat, Nov 10, 2012 at 03:49:21PM +0000, halfdog wrote:
> Hash: SHA1

> Herbert Poetzl wrote:
>> On Wed, Nov 07, 2012 at 09:53:02PM +0000, halfdog wrote: Herbert
>> Poetzl wrote:
>>>> On Wed, Nov 07, 2012 at 04:13:48PM +0000, halfdog wrote:
>>>> Security
>>>>> testing showed that when an admin enters a vserver guest from
>>>>> interactive shell, a malicious user inside the guest can use
>>>>> this to execute commands on the host. ...

>>>> TIOCSTI only works if enabled for a guest (VXC_TIOCSTI) so
>>>> unless you have found a bug to circumvent this, I think
>>>> Linux-VServer is not affected.

>> no, it shouldn't be enabled by default. you can check it either via
>> 'vattribute --get ...' or by looking at the CCAPS in 'cat
>> /proc/virtual/<xid>/status' VXC_TIOCSTI is defined as 0x00000010,
>> so it is bit #4

> I think, Corey did a perfect analysis, so issue is confirmed by
> source analsis.

> Just for the records, Herbert you were right regarding caps:
> VXC_TIOCSTI is not enabled by default (secure default),

> although stat allows guest to detect all available ptys
> on host and guest (compare guest "ls /dev/pts/" to "stat
> /dev/pts/[num]" where num is valid on host but not visible to
> guest)

that sounds interesting, thanks for the info, will look into
it where this check is missing (i.e. probably will be fixed soon)

> I have not found any other ways to manipulate ttys
> using TIOCSTI or other methods, nor within or between guests.

good, so I can assume that we are safe in regards to TIOCSTI
but I'll think about disabling it in general or per guest for
the next release to make it even safer ...


> # cat /proc/virtual/40000/status
> UseCnt: 5
> Tasks: 2
> Flags: 0000001602020010
> BCaps: ffffffffb44c04ff
> CCaps: 0000000000004101
> Umask: 0
> Wmask: 0
> Spaces: 0c020200 00020200

> hd

> - --
> PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
> Version: GnuPG v1.4.11 (GNU/Linux)

> iEYEARECAAYFAlCed3QACgkQxFmThv7tq+5j5gCdFo5yBqPrpx6+qc6bf0psNk9m
> R5kAnAlrtpRF5g81zJZyJNRZXzoM7y7F
> =tRzk
Received on Sat Nov 10 18:47:02 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sat 10 Nov 2012 - 18:47:02 GMT by hypermail 2.1.8