From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] sysctl.conf: prevent autoloading of TTY line disciplines
Date: Tue, 06 Apr 2021 11:15:22 +0100
Message-ID: <9AEBFF01-D158-4365-8764-99707003D25C@ipfire.org>
In-Reply-To: <92f0b0b7-530f-214f-d14f-9d8c9cbb60d7@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7514569018461136319=="
List-Id: <development.lists.ipfire.org>

--===============7514569018461136319==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Okay, merged.

> On 2 Apr 2021, at 20:30, Peter M=C3=BCller <peter.mueller(a)ipfire.org> wro=
te:
>=20
> Hello Michael,
>=20
> it seems as the kernel folks backported this into 4.14.x by now:
>=20
>> [root(a)maverick ~]# uname -a
>> Linux maverick 4.14.212-ipfire #1 SMP Wed Dec 16 12:01:25 GMT 2020 x86_64 =
Intel(R) Celeron(R) CPU N3150 @ 1.60GHz GenuineIntel GNU/Linux
>> [root(a)maverick ~]# sysctl dev.tty.ldisc_autoload
>> dev.tty.ldisc_autoload =3D 1
>=20
> Therefore, I would like to see this patch being merged - that is, if it is =
still applicable. :-)
>=20
> Thanks, and best regards,
> Peter M=C3=BCller
>=20
>=20
>> Hello Michael,
>>=20
>> grmpf, overlooked some patched distribution kernel again. :-/
>>=20
>> Sorry for the noise - I will keep the patch queued and wait for kernel 5.9=
 ...
>>=20
>> Thanks, and best regards,
>> Peter M=C3=BCller
>>=20
>>=20
>>> This does not exist before kernel 5.1.
>>>=20
>>> -Michael
>>>=20
>>>> On 5 Oct 2020, at 20:45, Peter M=C3=BCller <peter.mueller(a)ipfire.org> =
wrote:
>>>>=20
>>>> Malicious/vulnerable TTY line disciplines have been subject of some
>>>> kernel exploits such as CVE-2017-2636, and since - to put it in Greg
>>>> Kroah-Hatrman's words - we do not "trust the userspace to do the right
>>>> thing", this reduces local kernel attack surface.
>>>>=20
>>>> Further, there is no legitimate reason why an unprivileged user should
>>>> load kernel modules during runtime, anyway.
>>>>=20
>>>> See also:
>>>> - https://lkml.org/lkml/2019/4/15/890
>>>> - https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html
>>>>=20
>>>> Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org>
>>>> Cc: Michael Tremer <michael.tremer(a)ipfire.org>
>>>> Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
>>>> ---
>>>> config/etc/sysctl.conf | 4 ++++
>>>> 1 file changed, 4 insertions(+)
>>>>=20
>>>> diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
>>>> index d48c7734e..b5ede15ed 100644
>>>> --- a/config/etc/sysctl.conf
>>>> +++ b/config/etc/sysctl.conf
>>>> @@ -39,6 +39,10 @@ net.bridge.bridge-nf-call-ip6tables =3D 0
>>>> net.bridge.bridge-nf-call-iptables =3D 0
>>>> net.bridge.bridge-nf-call-arptables =3D 0
>>>>=20
>>>> +# Restrict loading TTY line disciplines to CAP_SYS_MODULE to prevent un=
privileged attackers
>>>> +# from loading vulnerable line disciplines with the TIOCSETD ioctl.
>>>> +dev.tty.ldisc_autoload =3D 0
>>>> +
>>>> # Try to keep kernel address exposures out of various /proc files (kalls=
yms, modules, etc).
>>>> kernel.kptr_restrict =3D 2
>>>>=20
>>>> --=20
>>>> 2.26.2
>>>=20


--===============7514569018461136319==--