[From nobody Wed Oct 7 11:21:08 2026 Received: (at submit) by bugs.debian.org; 14 Aug 2026 15:03:55 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=4.0 tests=BAYES_00,MD5_SHA1_SUM, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 25; hammy, 150; neutral, 56; spammy, 0. spammytokens: hammytokens:0.000-+--UD:security-tracker.debian.org, 0.000-+--security-tracker.debian.org, 0.000-+--securitytrackerdebianorg, 0.000-+--H*r:jmm, 0.000-+--sk:team@se Return-path: <jmm@inutil.org> Received: from inutil.org ([51.38.114.215]:41900 helo=vps-b7ad3695.vps.ovh.net) by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <jmm@inutil.org>) id 1wutRp-003Nfw-2v for submit@bugs.debian.org; Fri, 14 Aug 2026 15:03:55 +0000 Received: from soju.fritz.box (p5089a55b.dip0.t-ipconnect.de [80.137.165.91]) by vps-b7ad3695.vps.ovh.net (Postfix) with ESMTPSA id C22D41BC for <submit@bugs.debian.org>; Fri, 14 Aug 2026 15:03:49 +0000 (UTC) Received: from jmm by soju.fritz.box with local (Exim 4.99.4) (envelope-from <jmm@soju.westfalen.local>) id 1wutRk-00000000Oz7-2ikx for submit@bugs.debian.org; Fri, 14 Aug 2026 17:03:48 +0200 Date: Fri, 14 Aug 2026 17:03:48 +0200 To: submit@bugs.debian.org Subject: kdb: CVE-2026-72693 Message-ID: <an8uVBPm8pWQqBV0@pisco.westfalen.local> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline From: =?UTF-8?Q?Moritz_M=C3=BChlenhoff?= <jmm@inutil.org> Delivered-To: submit@bugs.debian.org Source: kdb X-Debbugs-CC: team@security.debian.org Severity: grave Tags: security Hi, The following vulnerability was published for kdb. CVE-2026-72693[0]: | `openvt -u` is intended to identify the owner of the current VT and | then execute `login` as that user from a privileged context. In the | documented `kbrequest`/init usage, the ownership test in | `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` | on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY | device node. As a result, `buf.st_uid` reflects the owner of the TTY | node rather than the owner of the process holding the file | descriptor. If the TTY owner returns to `root` or the getty owner | after logout while an unprivileged process still has `fd 0` attached | to that TTY, the check can incorrectly treat that process as | belonging to the privileged console owner. Once that check succeeds, | the `-u` path executes a passwordless login as the selected user. In | the documented `kbrequest`/init deployment using `openvt -us`, this | can result in passwordless `login -f root` on the spawned VT. This | report establishes that privilege escalation path for that | documented deployment; it does not claim equivalent reachability for | deployments that do not use `openvt -u` from a privileged | `kbrequest`/init path. https://bugzilla.redhat.com/show_bug.cgi?id=2462115 Fixed by: https://github.com/legionus/kbd/commit/78d5ae119742e87baa7dbe0f5c4107e7533fd698 (v2.10.0) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-72693 https://www.cve.org/CVERecord?id=CVE-2026-72693 Please adjust the affected versions in the BTS as needed. ]