From mboxrd@z Thu Jan  1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] sysctl.conf: prevent autoloading of TTY line disciplines
Date: Tue, 06 Oct 2020 13:03:18 +0000
Message-ID: <2c3adcb9-d6e1-ba67-41fa-ae1c4bce3527@ipfire.org>
In-Reply-To: <75BC505A-7F01-435B-B865-4E575684FC86@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0014066311388543784=="
List-Id: <development.lists.ipfire.org>

--===============0014066311388543784==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hello Michael,

grmpf, overlooked some patched distribution kernel again. :-/

Sorry for the noise - I will keep the patch queued and wait for kernel 5.9 ...

Thanks, and best regards,
Peter M=C3=BCller


> This does not exist before kernel 5.1.
>=20
> -Michael
>=20
>> On 5 Oct 2020, at 20:45, Peter M=C3=BCller <peter.mueller(a)ipfire.org> wr=
ote:
>>
>> Malicious/vulnerable TTY line disciplines have been subject of some
>> kernel exploits such as CVE-2017-2636, and since - to put it in Greg
>> Kroah-Hatrman's words - we do not "trust the userspace to do the right
>> thing", this reduces local kernel attack surface.
>>
>> Further, there is no legitimate reason why an unprivileged user should
>> load kernel modules during runtime, anyway.
>>
>> See also:
>> - https://lkml.org/lkml/2019/4/15/890
>> - https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html
>>
>> Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org>
>> Cc: Michael Tremer <michael.tremer(a)ipfire.org>
>> Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
>> ---
>> config/etc/sysctl.conf | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
>> index d48c7734e..b5ede15ed 100644
>> --- a/config/etc/sysctl.conf
>> +++ b/config/etc/sysctl.conf
>> @@ -39,6 +39,10 @@ net.bridge.bridge-nf-call-ip6tables =3D 0
>> net.bridge.bridge-nf-call-iptables =3D 0
>> net.bridge.bridge-nf-call-arptables =3D 0
>>
>> +# Restrict loading TTY line disciplines to CAP_SYS_MODULE to prevent unpr=
ivileged attackers
>> +# from loading vulnerable line disciplines with the TIOCSETD ioctl.
>> +dev.tty.ldisc_autoload =3D 0
>> +
>> # Try to keep kernel address exposures out of various /proc files (kallsym=
s, modules, etc).
>> kernel.kptr_restrict =3D 2
>>
>> --=20
>> 2.26.2
>=20

--===============0014066311388543784==--