Re: Telnetd Vulnerability Report

--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Erik Auerswald <[email protected]> writes:

> Hi all,
>
> I plan to commit and push the attached patch in a few days to address
> this vulnerability, unless there are reasonable objections.

Thanks -- I wish we could implement the --accept-env approach and make
the default not set any environment variables at all, but I don't have
cycles to work on that.  Anyone else?  Your patch seems to close this
vulnerability report in a most minimal way, so IMHO we should apply it.

/Simon

> Cheers,
> Erik
>
>
> On Thu, Feb 12, 2026 at 03:22:47PM +0200, Ron Ben Yizhak wrote:
>> Hi,
>>=20
>> Following this report, I wanted to ask - do you have any estimation for a
>> fix release date, and a CVE release?
>>=20
>> Best regards,
>> Ron Ben Yizhak
>>=20
>> On Mon, Feb 9, 2026 at 11:37=E2=80=AFAM Ron Ben Yizhak <ron.benyizhak@sa=
febreach.com>
>> wrote:
>>=20
>> > Hello,
>> >
>> > Thank you for consulting with me. As a vulnerability researcher, I do =
not
>> > want to take responsibility for the effectiveness of the fix.
>> > With that being said, In my opinion the proposed fix will stop this
>> > exploit, but the main issue stays. The issue exists as long as
>> > unauthenticated clients can set arbitrary environment variables in the
>> > memory of telnetd and its sub processes.
>> > The best solution will be that the environment variables set by the cl=
ient
>> > will only apply on the shell process and only after the client has alr=
eady
>> > authenticated. No process running as root should run with any environm=
ent
>> > variables set by the client.
>> >
>> > Best regards,
>> > Ron Ben Yizhak
>> >
>> > On Mon, Feb 9, 2026 at 11:21=E2=80=AFAM Erik Auerswald <auerswal@unix-=
ag.uni-kl.de>
>> > wrote:
>> >
>> >> Hi Ron Ben Yizhak,
>> >>
>> >> On Fri, Feb 06, 2026 at 06:27:30PM +0100, Erik Auerswald wrote:
>> >> > On Thu, Feb 05, 2026 at 02:39:57PM +0200, Ron Ben Yizhak via Bug
>> >> reports for the GNU Internet utilities wrote:
>> >> > >
>> >> > > My name is Ron Ben Yizhak and I am a security researcher from
>> >> SafeBreach.
>> >> > >
>> >> > > I want to report a severe vulnerability that I found in telnetd f=
rom
>> >> the
>> >> > > repository https://codeberg.org/inetutils/inetutils
>> >> > > [...]
>> >> >
>> >> > [...] a quick and dirty hack that should stop this method is contai=
ned
>> >> > in the attached patch.  I have tested it with the above mentioned
>> >> > method only.
>> >>
>> >> Can you confirm that the patch[0] from my previous message[1] stops
>> >> the exploit?
>> >>
>> >> [0]
>> >> https://lists.gnu.org/archive/html/bug-inetutils/2026-02/txt5Lp7CdbQk=
O.txt
>> >> [1]
>> >> https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00001.html
>> >>
>> >> > [...]
>> >> > A possible workaround would be to use an older version of "login".
>> >>
>> >> Another possible workaround would be to wrap "login" execution with
>> >> "env", and use "env" to unset the problematic environment variable
>> >> "CREDENTIALS_DIRECTORY".  The inetd.conf line could look as below:
>> >>
>> >> telnet stream tcp nowait root /usr/local/libexec/telnetd telnetd
>> >> --exec-login "/usr/bin/env -u CREDENTIALS_DIRECTORY /usr/bin/login -p=
 -h %h
>> >> %?u{-f -- %u}{-- %U}"
>> >>
>> >> Can you confirm that this stops the exploit?
>> >>
>> >> Thanks,
>> >> Erik
>
> From 4db2f19f4caac03c7f4da6363c140bd70df31386 Mon Sep 17 00:00:00 2001
> From: Erik Auerswald <[email protected]>
> Date: Sun, 15 Feb 2026 15:38:50 +0100
> Subject: [PATCH] telnetd: don't allow systemd service credentials
>
> The login(1) implementation of util-linux added support for
> systemd service credentials in release 2.40.  This allows to
> bypass authentication by specifying a directory name in the
> environment variable CREDENTIALS_DIRECTORY.  If this directory
> contains a file named 'login.noauth' with the content of 'yes',
> login(1) skips authentication.
>
> GNU Inetutils telnetd supports to set arbitrary environment
> variables using the 'Environment' and 'New Environment'
> Telnet options.  This allows specifying a directory containing
> 'login.noauth'.  A local user can create such a directory
> and file, and, e.g., specify the user name 'root' to escalate
> privileges.
>
> This problem was reported by Ron Ben Yizhak in
> <https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html>.
>
> This commit clears CREDENTIALS_DIRECTORY from the environment
> before executing login(1) to implement a simple fix that can
> be backported easily.
>
> * NEWS.md: Mention fix.
> * THANKS: Mention Ron Ben Yizhak.
> * telnetd/pty.c: Clear CREDENTIALS_DIRECTORY from the environment
> before executing 'login'.
> ---
>  NEWS.md       | 5 +++++
>  THANKS        | 1 +
>  telnetd/pty.c | 8 ++++++++
>  3 files changed, 14 insertions(+)
>
> diff --git a/NEWS.md b/NEWS.md
> index 877ca53b..f5172a71 100644
> --- a/NEWS.md
> +++ b/NEWS.md
> @@ -6,6 +6,11 @@ GNU inetutils NEWS -- history of user-visible changes.
>  Reported by Kyu Neushwaistein.  Initial patch by Paul Eggert; further
>  improvements and security advisory by Simon Josefsson.
>=20=20
> +** Prevent privilege escalation via telnetd abusing systemd service
> +credentials support added to the login(1) implementation of util-linux
> +in release 2.40.  Reported by Ron Ben Yizhak in
> +<https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html>.
> +
>  ** telnet: Drop everything related to TN3270.
>  The code did not build (several missing required header files) and
>  even if we could fix it, we have no way to test it. It may contain
> diff --git a/THANKS b/THANKS
> index 8d1d3dbb..ef5f6063 100644
> --- a/THANKS
> +++ b/THANKS
> @@ -10,6 +10,7 @@ In particular:
>    Nathan Neulinger       (tftpd)
>    Thomas Bushnell        (sockaddr sin_len field)
>    Kyu Neushwaistein      (reported remote root exploit in telnetd)
> +  Ron Ben Yizhak         (reported privilege escalation via telnetd)
>=20=20
>  Please see version control logs and ChangeLog.? for full credits.
>=20=20
> diff --git a/telnetd/pty.c b/telnetd/pty.c
> index c727e7be..f3518049 100644
> --- a/telnetd/pty.c
> +++ b/telnetd/pty.c
> @@ -129,6 +129,14 @@ start_login (char *host, int autologin, char *name)
>    if (!cmd)
>      fatal (net, "can't expand login command line");
>    argcv_get (cmd, "", &argc, &argv);
> +
> +  /* util-linux's "login" introduced an authentication bypass method
> +   * via environment variable "CREDENTIALS_DIRECTORY" in version 2.40.
> +   * Clear it from the environment before executing "login" to prevent
> +   * abuse via Telnet.
> +   */
> +  unsetenv ("CREDENTIALS_DIRECTORY");
> +
>    execv (argv[0], argv);
>    syslog (LOG_ERR, "%s: %m\n", cmd);
>    fatalperror (net, cmd);

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQNoBAEWCgMQFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmmR6BgUHHNpbW9uQGpv
c2Vmc3Nvbi5vcmfCHCYAmDMEXJLOtBYJKwYBBAHaRw8BAQdACIcrZIvhrxDBkK9f
V+QlTmXxo2naObDuGtw58YaxlOu0JVNpbW9uIEpvc2Vmc3NvbiA8c2ltb25Aam9z
ZWZzc29uLm9yZz6IlgQTFggAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYh
BLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XQkBQkNZGbwAAoJENc89jjFPAa+BtIA
/iR73CfBurG9y8pASh3cbGOMHpDZfMAtosu6jbpO69GHAP4p7l57d+iVty2VQMsx
+3TCSAvZkpr4P/FuTzZ8JZe8BrgzBFySz4EWCSsGAQQB2kcPAQEHQOxTCIOaeXAx
I2hIX4HK9bQTpNVei708oNr1Klm8qCGKiPUEGBYIACYCGwIWIQSx0r0Tdb7LeEz0
+MTXPPY4xTwGvgUCZ9F0SgUJDWRmSQCBdiAEGRYIAB0WIQSjzJyHC50xCrrUzy9R
cisI/kdFogUCXJLPgQAKCRBRcisI/kdFoqdMAQCgH45aseZgIrwKOvUOA9QfsmeE
8GZHYNuFHmM9FEQS6AD6A4x5aYvoY6lo98pgtw2HPDhmcCXFItjXCrV4A0GmJA4J
ENc89jjFPAa+wUUBAO64fbZek6FPlRK0DrlWsrjCXuLi6PUxyzCAY6lG2nhUAQC6
qobB9mkZlZ0qihy1x4JRtflqFcqqT9n7iUZkCDIiDbg4BFySz2oSCisGAQQBl1UB
BQEBB0AxlRumDW6nZY7A+VCfek9VpEx6PJmdJyYPt3lNHMd6HAMBCAeIfgQYFggA
JgIbDBYhBLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XTSBQkNZGboAAoJENc89jjF
PAa+0M0BAPPRq73kLnHYNDMniVBOzUdi2XeF32idjEWWfjvyIJUOAP4wZ+ALxIeh
is3Uw2BzGZE6ttXQ2Q+DeCJO3TPpIqaXDAAKCRBRcisI/kdFosgNAQDh77xDijj8
/HZo7NGH0Ml6yOY+EBgdl6903PPeHL9oLAEAg++ZZoVHliG0jd9qsx/611bTc+67
7g1VubefF2yUog4=
=Tjbl
-----END PGP SIGNATURE-----
--=-=-=--