Do Son 
TL;DR
Security researchers have detailed a critical Linux suTrap local privilege escalation flaw. This interactive su TIOCSTI bug allows an unprivileged user to gain root access during an active session. Furthermore, the vulnerability details and a proof-of-concept exploit code are now publicly disclosed. Therefore, administrators must take immediate action to secure their environments.
Why It Matters
System administrators frequently use the su command to drop privileges for application testing. This common habit now presents a severe security risk. Attackers can exploit this Linux suTrap LPE flaw to hijack these sessions. They can then easily execute arbitrary system commands as root. Consequently, the public release of the exploit code drastically increases the likelihood of widespread attacks. Threat actors actively monitor for such publicly disclosed vulnerabilities. This issue follows a pattern of recent shadow-utils vulnerabilities, such as CVE-2023-4641 and CVE-2024-56433. Organizations must treat this threat with high priority to prevent system compromises.
How The Attack Works
Specifically, the vulnerability stems from how the shadow-utils package handles interactive terminal sessions. When root runs the su command interactively, the process skips essential terminal isolation code. Consequently, the target user directly inherits the controlling terminal from root. Next, attackers can use a background process to inject keystrokes into the shared terminal buffer. They achieve this by abusing the legacy TIOCSTI ioctl feature. Finally, when the administrator types the exit command, the original root shell consumes those inputs. The root shell then executes these malicious keystrokes as legitimate commands. This sequence ultimately grants total root-level privileges to the attacker.
Affected Versions
The vulnerability currently impacts multiple popular enterprise Linux distributions. Additionally, RHEL 9, Rocky Linux 9, and AlmaLinux 9 are highly vulnerable. These specific systems use kernel 5.14 with the legacy TIOCSTI option left enabled. Meanwhile, older legacy systems like CentOS 7 and RHEL 8 also remain entirely exposed. Amazon Linux 2023 and Docker Desktop environments share this exact vulnerability. Conversely, newer distributions like Ubuntu 24.04 and recent Fedora releases disable legacy TIOCSTI by default. Therefore, these modern operating systems remain naturally protected against this specific attack vector.
Patch Or Mitigation Steps
To resolve this, users should immediately upgrade to shadow-utils version 4.20.0 or later. This updated version correctly detects and rejects vulnerable configurations. Alternatively, administrators can mitigate the threat by disabling legacy TIOCSTI system-wide. You can achieve this manually by setting the kernel parameter dev.tty.legacy_tiocsti to 0. Moreover, organizations should completely avoid running interactive su sessions from root to unprivileged accounts. Administrators should prefer using safer alternatives like sudo or su with the pty flag enabled.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
