This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH] BZ #15755: CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal
- From: Markus Trippelsdorf <markus at trippelsdorf dot de>
- To: Carlos O'Donell <carlos at redhat dot com>
- Cc: GNU C Library <libc-alpha at sourceware dot org>, David Miller <davem at davemloft dot net>, Roland McGrath <roland at hack dot frob dot com>, Andreas Schwab <schwab at suse dot de>, Andreas Jaeger <aj at suse dot com>, "Joseph S. Myers" <joseph at codesourcery dot com>, Ryan Arnold <rsa at us dot ibm dot com>, Alexandre Oliva <aoliva at redhat dot com>, Siddhesh Poyarekar <siddhesh at redhat dot com>
- Date: Thu, 25 Jul 2013 17:33:39 +0200
- Subject: Re: [PATCH] BZ #15755: CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal
- References: <51E8D4C1 dot 9000705 at redhat dot com> <20130725140700 dot GA355 at x4> <51F14382 dot 2080608 at redhat dot com>
On 2013.07.25 at 11:25 -0400, Carlos O'Donell wrote:
> On 07/25/2013 10:07 AM, Markus Trippelsdorf wrote:
> > On 2013.07.19 at 01:55 -0400, Carlos O'Donell wrote:
> >> CVE-2013-2207: pt_chown tricked into granting access to another
> >> users pseudo-terminal
> >
> > Just a heads up.
> >
> > This patch causes Konsole and tmux startup failures on my machine, e.g.:
> > konsole(364)/kdecore (KPty/K3Process) KPty::open: Can't open a pseudo teletype
> >
> > To fix this issue I had to remount devpts with gid=5:
> > mount -o remount,gid=5 /dev/pts/
> >
> > My original fstab had this entry:
> > devpts /dev/pts devpts rw,relatime,mode=600 0 0
>
> That is the expected behaviour. The GNU C Library 2.18 expects you
> to have /dev/pts setup correctly.
>
> Would an additional explanation in NEWS have helped?
Yes. A short explanation in NEWS would be appreciated.
Because it's not totally obvious how to fix this issue when you first
encounter it. (It took me a couple of google searches).
> I've added notes here:
> http://sourceware.org/glibc/wiki/Release/2.18#Packaging_Changes
Thanks.
--
Markus