Re: [Bug Report] GNU inetutils telnetd Local Privilege Escalation

--0000000000006291d4064c416070
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Collin,

Thank you for the pointer =E2=80=94 we were not aware of Justin Swartz's ea=
rlier
report [1]. We acknowledge that our finding is a duplicate.

We verified the exploit on both inetutils 2.0 (Debian Bullseye) and
2.7 (Debian sid, 2:2.7-3). The GCONV_PATH vector remains fully
exploitable on the latest released version as of today. Our report
includes a complete, self-contained PoC (Dockerfile, payload source,
gconv-modules, and step-by-step reproduction instructions) =E2=80=94 we are
happy to share the full package if it would be helpful for developing
and testing a fix.

Regarding the patch, we recommend that scrub_env() should filter =E2=80=94 =
at
minimum =E2=80=94 all variables defined in glibc's UNSECURE_ENVVARS [2]:

  GCONV_PATH, GETCONF_DIR, GLIBC_TUNABLES, HOSTALIASES,
  LD_AUDIT, LD_BIND_NOT, LD_BIND_NOW, LD_DEBUG,
  LD_DEBUG_OUTPUT, LD_DYNAMIC_WEAK, LD_LIBRARY_PATH,
  LD_ORIGIN_PATH, LD_PRELOAD, LD_PROFILE, LD_PROFILE_OUTPUT,
  LD_SHOW_AUXV, LD_VERBOSE, LD_WARN, LOCALDOMAIN, LOCPATH,
  MALLOC_ARENA_MAX, MALLOC_ARENA_TEST, MALLOC_MMAP_MAX_,
  MALLOC_MMAP_THRESHOLD_, MALLOC_PERTURB_, MALLOC_TOP_PAD_,
  MALLOC_TRACE, MALLOC_TRIM_THRESHOLD_, NIS_PATH, NLSPATH,
  RESOLV_HOST_CONF, RES_OPTIONS, TMPDIR, TZDIR

These variables are stripped by the dynamic linker when AT_SECURE=3D1,
but telnetd's root-to-root exec of login means AT_SECURE=3D0 and they
all pass through unchecked. Ideally, as Justin also suggested, a
whitelist-based approach (similar to OpenSSH's AcceptEnv) would be
more robust than extending the current blacklist.

Could you let us know when a patch is committed? We would like to
verify the fix on our end.

Best regards,
Shi Weiming
STAR Labs

[1] https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00017.html
[2]
https://elixir.bootlin.com/glibc/glibc-2.43.9000/source/sysdeps/generic/uns=
ecvars.h#L4

On Thu, Mar 5, 2026 at 5:16=E2=80=AFAM Collin Funk <[email protected]>=
 wrote:

> "Labs, STAR" <[email protected]> writes:
>
> > our team member, Shi Weiming, would like to report the following bug in
> GNU
> > inetutils telnetd.
> >
> > # GNU inetutils telnetd Local Privilege Escalation via GCONV_PATH
> > Environment Variable Injection
>
> This appears to be a duplicate of the issue mentioned by Justin Swartz [1=
].
>
> Collin
>
> [1] https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00017.htm=
l
>

--0000000000006291d4064c416070
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Collin,<br><div><br></div><div>Thank you for the pointe=
r =E2=80=94 we were not aware of Justin Swartz&#39;s earlier<br>report [1].=
 We acknowledge that our finding is a duplicate.<br><br>We verified the exp=
loit on both inetutils 2.0 (Debian Bullseye) and<br>2.7 (Debian sid, 2:2.7-=
3). The GCONV_PATH vector remains fully<br>exploitable on the latest releas=
ed version as of today. Our report<br>includes a complete, self-contained P=
oC (Dockerfile, payload source,<br>gconv-modules, and step-by-step reproduc=
tion instructions) =E2=80=94 we are<br>happy to share the full package if i=
t would be helpful for developing<br>and testing a fix.<br><br>Regarding th=
e patch, we recommend that scrub_env() should filter =E2=80=94 at<br>minimu=
m =E2=80=94 all variables defined in glibc&#39;s UNSECURE_ENVVARS [2]:<br><=
br>=C2=A0 GCONV_PATH, GETCONF_DIR, GLIBC_TUNABLES, HOSTALIASES,<br>=C2=A0 L=
D_AUDIT, LD_BIND_NOT, LD_BIND_NOW, LD_DEBUG,<br>=C2=A0 LD_DEBUG_OUTPUT, LD_=
DYNAMIC_WEAK, LD_LIBRARY_PATH,<br>=C2=A0 LD_ORIGIN_PATH, LD_PRELOAD, LD_PRO=
FILE, LD_PROFILE_OUTPUT,<br>=C2=A0 LD_SHOW_AUXV, LD_VERBOSE, LD_WARN, LOCAL=
DOMAIN, LOCPATH,<br>=C2=A0 MALLOC_ARENA_MAX, MALLOC_ARENA_TEST, MALLOC_MMAP=
_MAX_,<br>=C2=A0 MALLOC_MMAP_THRESHOLD_, MALLOC_PERTURB_, MALLOC_TOP_PAD_,<=
br>=C2=A0 MALLOC_TRACE, MALLOC_TRIM_THRESHOLD_, NIS_PATH, NLSPATH,<br>=C2=
=A0 RESOLV_HOST_CONF, RES_OPTIONS, TMPDIR, TZDIR<br><br>These variables are=
 stripped by the dynamic linker when AT_SECURE=3D1,<br>but telnetd&#39;s ro=
ot-to-root exec of login means AT_SECURE=3D0 and they<br>all pass through u=
nchecked. Ideally, as Justin also suggested, a<br>whitelist-based approach =
(similar to OpenSSH&#39;s AcceptEnv) would be<br>more robust than extending=
 the current blacklist.<br><br>Could you let us know when a patch is commit=
ted? We would like to<br>verify the fix on our end.<br><br>Best regards,<br=
>Shi Weiming<br>STAR Labs<br><br>[1] <a href=3D"https://lists.gnu.org/archi=
ve/html/bug-inetutils/2026-02/msg00017.html">https://lists.gnu.org/archive/=
html/bug-inetutils/2026-02/msg00017.html</a><br>[2] <a href=3D"https://elix=
ir.bootlin.com/glibc/glibc-2.43.9000/source/sysdeps/generic/unsecvars.h#L4"=
>https://elixir.bootlin.com/glibc/glibc-2.43.9000/source/sysdeps/generic/un=
secvars.h#L4</a><br></div></div><br><div class=3D"gmail_quote gmail_quote_c=
ontainer"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Mar 5, 2026 at 5:16=
=E2=80=AFAM Collin Funk &lt;<a href=3D"mailto:[email protected]">colli=
[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote"=
 style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:=
solid;border-left-color:rgb(204,204,204);padding-left:1ex">&quot;Labs, STAR=
&quot; &lt;<a href=3D"mailto:[email protected]" target=3D"_blank">info@starl=
abs.sg</a>&gt; writes:<br>
<br>
&gt; our team member, Shi Weiming, would like to report the following bug i=
n GNU<br>
&gt; inetutils telnetd.<br>
&gt;<br>
&gt; # GNU inetutils telnetd Local Privilege Escalation via GCONV_PATH<br>
&gt; Environment Variable Injection<br>
<br>
This appears to be a duplicate of the issue mentioned by Justin Swartz [1].=
<br>
<br>
Collin<br>
<br>
[1] <a href=3D"https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg=
00017.html" rel=3D"noreferrer" target=3D"_blank">https://lists.gnu.org/arch=
ive/html/bug-inetutils/2026-02/msg00017.html</a><br>
</blockquote></div>

--0000000000006291d4064c416070--