Description
plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | py3-udev +1 | No fix yet | — |
References
- 45046 vdb-entry
- FEDORA-2010-17912 vendor-advisory
- 42342 third-party-advisory
- 42451 third-party-advisory
- FEDORA-2010-17930 vendor-advisory
- ADV-2010-3110 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=654489
- ADV-2010-3062 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=654935