Description

`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T09:17:14.340Z",
  "pubdate": "2026-08-11T09:17:14.340Z",
  "executiveSummary": "The vulnerability is an authentication bypass and local privilege escalation flaw residing in the openvt utility when executed with the -u flag.\nThe impact of this vulnerability is the execution of a passwordless login as the console owner, specifically resulting in passwordless root access when deployed via kbrequest and init using openvt -us.\nAffected systems include environments utilizing openvt -u within privileged kbrequest and init paths where unprivileged processes can retain file descriptors attached to TTY devices.\nThe risk implications are severe, as unprivileged local users can potentially escalate privileges to root without providing credentials.\nAttacker capabilities require local execution access and the ability to maintain a file descriptor pointing to a target TTY device after a user session logs out and ownership reverts.\nExploitation requirements include a specific documented deployment pattern utilizing privileged openvt -u invocations via kbrequest or init, along with race conditions involving TTY ownership transitions.",
  "technicalDetails": "The root cause of the vulnerability lies in the authenticate_user function within openvt, which attempts to identify the owner of the current virtual terminal by invoking stat() on the path /proc/<pid>/fd/0.\nBecause the stat() system call follows symbolic links pointing to the underlying TTY device node rather than evaluating the security context of the process holding the file descriptor, the resulting st_uid field reflects the ownership of the TTY device node itself rather than the actual user owning the target process.\nThe vulnerable component is the openvt command-line utility, specifically when executed with the -u flag to spawn a session from a privileged context such as init or kbrequest handlers.\nThe attack flow proceeds as follows: an unprivileged process retains standard input (file descriptor 0) attached to a specific TTY device node. The legitimate user or getty session on that TTY subsequently logs out, causing the ownership of the TTY device node to revert back to root or the designated getty owner.\nWhile the unprivileged process still maintains its file descriptor attached to the TTY, a trigger via kbrequest invokes openvt -us from a privileged context. When authenticate_user() executes, it evaluates the ownership of the TTY device node via /proc/<pid>/fd/0.\nDue to the flawed use of stat(), the ownership check incorrectly associates the unprivileged process with the privileged console owner because the underlying TTY node is owned by root or getty, and the check fails to validate the true process UID accurately.\nOnce this flawed authentication check succeeds, the openvt -u execution path proceeds to invoke login as the selected user without requesting a password.\nIn the documented kbrequest and init deployment context using openvt -us, this permits an unprivileged local attacker to trigger a passwordless login -f root command, achieving arbitrary root privilege escalation on the spawned virtual terminal.\nThe vulnerability requires local access, specific privileged deployment parameters involving openvt -u, and precise timing relative to user logouts and TTY ownership reassignment."
}