Bug#334113: kernel allows loadkeys to be used by any user, allowing for local root compromise

[Krzysztof Halasa <khc@pm.waw.pl>]

Horms <horms@verge.net.au> writes:

>> Then log out and let root login (in a computer pool, you can usually get
>> an admin to log on as root on a console somehow). The next time he'll
>> press TAB to complete a file name, he instead will run the shell
>> command.

Why doesn't the intruder just simulate login process (printing "login: "
and "Password:")? That's known and used for ages.

The root user (and any other user) should press the SAK key before
attempting login. It should a) reset terminal to a sane state,
b) terminate and/or disconnect all processes from current tty.

Alternatively, he/she should hw-reset/power-cycle the terminal,
if possible (say, with serial/X-terminal).

OTOH I don't know why ordinary users should be allowed to change key
bindings.

BTW: Not sure about Linux consoles, but in general ESCape sequences
can redefine key bindings as well. That's why SAK/reset is so important.
-- 
Krzysztof Halasa