Skip to content

[AutoPR- Security] Patch kbd for CVE-2026-72693 [HIGH] #18466

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Azure Linux Security Servicing Account (azurelinux-security) wants to merge 1 commit into
base: fasttrack/3.0
Choose a base branch
from
+156 −5
Draft

[AutoPR- Security] Patch kbd for CVE-2026-72693 [HIGH] #18466

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
147 changes: 147 additions & 0 deletions SPECS/kbd/CVE-2026-72693.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,147 @@
From 8f4dcf1e5fd12d6bf540da6f49f368e1399b16e4 Mon Sep 17 00:00:00 2001
From: AllSpark <allspark@microsoft.com>
Date: Sun, 16 Aug 2026 06:27:32 +0000
Subject: [PATCH] openvt: make -u process matching more conservative

Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: AI Backport of https://github.com/legionus/kbd/commit/78d5ae119742e87baa7dbe0f5c4107e7533fd698.patch
---
docs/man/man1/openvt.1 | 12 +++++++-
src/openvt.c | 65 +++++++++++++++++++++++++++++++++++++-----
2 files changed, 69 insertions(+), 8 deletions(-)

diff --git a/docs/man/man1/openvt.1 b/docs/man/man1/openvt.1
index 4712547..9b7ecd3 100644
--- a/docs/man/man1/openvt.1
+++ b/docs/man/man1/openvt.1
@@ -35,7 +35,9 @@ will be made the new current VT;
.TP
.I "\-u, \-\-user"
Figure out the owner of the current VT, and run login as that user.
-Suitable to be called by init. Shouldn't be used with \-c or \-l;
+Suitable to be called by init. Shouldn't be used with \-c or \-l.
+This option refuses to pre-authenticate root and requires a process owned by
+the VT owner whose controlling terminal is the current VT;
.TP
.I "\-l, \-\-login"
Make the command a login shell. A \- is prepended to the name of the command
@@ -64,6 +66,14 @@ If
is compiled with a getopt_long() and you wish to set
options to the command to be run, then you must supply
the end of options \-\- flag before the command.
+.PP
+The
+.B \-u
+option uses
+.BR "login -f"
+and therefore bypasses normal password authentication for the detected user.
+It is intended only for controlled init or keyboard-request configurations.
+Use a normal authenticated login command when authentication is required.
.BR
.SH EXAMPLES
.B openvt
diff --git a/src/openvt.c b/src/openvt.c
index fe74655..cdfacad 100644
--- a/src/openvt.c
+++ b/src/openvt.c
@@ -65,6 +65,52 @@ static void
exit(ret);
}

+
+static int
+proc_pid_stat(const char *pid, uid_t *uid, dev_t *tty)
+{
+ char filename[NAME_MAX + 12];
+ char line[BUFSIZ];
+ char *lp, *rp;
+ FILE *fp;
+ struct stat st;
+ long tty_nr;
+
+ snprintf(filename, sizeof(filename), "/proc/%s/stat", pid);
+ fp = fopen(filename, "r");
+ if (!fp)
+ return -1;
+
+ if (fstat(fileno(fp), &st)) {
+ fclose(fp);
+ return -1;
+ }
+
+ if (!fgets(line, sizeof(line), fp)) {
+ fclose(fp);
+ return -1;
+ }
+ fclose(fp);
+
+ rp = strrchr(line, ')');
+ if (!rp)
+ return -1;
+
+ /*
+ * /proc/<pid>/stat fields after comm are:
+ * state ppid pgrp session tty_nr ...
+ */
+ if (!rp || sscanf(rp + 1, " %*c %*d %*d %*d %ld", &tty_nr) != 1)
+ return -1;
+
+ if (tty_nr <= 0)
+ return -1;
+
+ *uid = st.st_uid;
+ *tty = (dev_t) tty_nr;
+ return 0;
+}
+
/*
* Support for Spawn_Console: openvt running from init
* added by Joshua Spoerri, Thu Jul 18 21:13:16 EDT 1996
@@ -96,8 +142,7 @@ authenticate_user(int curvt)
DIR *dp;
struct dirent *dentp;
struct stat buf;
- dev_t console_dev;
- ino_t console_ino;
+ dev_t console_rdev;
uid_t console_uid;
char filename[NAME_MAX + 12];
struct passwd *pwnam;
@@ -117,10 +162,12 @@ authenticate_user(int curvt)
kbd_error(EXIT_FAILURE, errsv, "%s", filename);
}
}
- console_dev = buf.st_dev;
- console_ino = buf.st_ino;
+ console_rdev = buf.st_rdev;
console_uid = buf.st_uid;

+ if (console_uid == 0)
+ kbd_error(EXIT_FAILURE, 0, _("Refusing to pre-authenticate root on current tty."));
+
/* get the owner of current tty */
if (!(pwnam = getpwuid(console_uid)))
kbd_error(EXIT_FAILURE, errno, "getpwuid");
@@ -128,12 +175,16 @@ authenticate_user(int curvt)
/* check to make sure that user has a process on that tty */
/* this will fail for example when X is running on the tty */
while ((dentp = readdir(dp))) {
- sprintf(filename, "/proc/%s/fd/0", dentp->d_name);
+ uid_t proc_uid;
+ dev_t proc_tty;
+
+ if (dentp->d_name[0] < '0' || dentp->d_name[0] > '9')
+ continue;

- if (stat(filename, &buf))
+ if (proc_pid_stat(dentp->d_name, &proc_uid, &proc_tty) < 0)
continue;

- if (buf.st_dev == console_dev && buf.st_ino == console_ino && buf.st_uid == console_uid)
+ if (proc_uid == console_uid && proc_tty == console_rdev)
goto got_a_process;
}

--
2.45.4

6 changes: 5 additions & 1 deletion SPECS/kbd/kbd.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,15 @@
Summary: Key table files, console fonts, and keyboard utilities
Name: kbd
Version: 2.2.0
Release: 2%{?dist}
Release: 3%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Group: Applications/System
URL: http://ftp.altlinux.org/pub/people/legion/kbd
Source0: http://ftp.altlinux.org/pub/people/legion/kbd/%{name}-%{version}.tar.xz
Patch0: kbd-2.0.4-backspace-1.patch
Patch1: CVE-2026-72693.patch

BuildRequires: check >= 0.9.4

Expand Down Expand Up @@ -57,6 +58,9 @@ make %{?_smp_mflags} check
%{_mandir}/*/*

%changelog
* Sun Aug 16 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.2.0-3
- Patch for CVE-2026-72693

* Thu Feb 15 2024 Pawel Winogrodzki <pawelwi@microsoft.com> - 2.2.0-2
- Updated patch application macros.

Expand Down
4 changes: 2 additions & 2 deletions toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,8 +156,8 @@ gzip-1.13-2.azl3.aarch64.rpm
gzip-debuginfo-1.13-2.azl3.aarch64.rpm
intltool-0.51.0-7.azl3.noarch.rpm
itstool-2.0.7-1.azl3.noarch.rpm
kbd-2.2.0-2.azl3.aarch64.rpm
kbd-debuginfo-2.2.0-2.azl3.aarch64.rpm
kbd-2.2.0-3.azl3.aarch64.rpm
kbd-debuginfo-2.2.0-3.azl3.aarch64.rpm
kernel-headers-6.6.150.1-1.azl3.noarch.rpm
kmod-30-1.azl3.aarch64.rpm
kmod-debuginfo-30-1.azl3.aarch64.rpm
Expand Down
4 changes: 2 additions & 2 deletions toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,8 +163,8 @@ gzip-1.13-2.azl3.x86_64.rpm
gzip-debuginfo-1.13-2.azl3.x86_64.rpm
intltool-0.51.0-7.azl3.noarch.rpm
itstool-2.0.7-1.azl3.noarch.rpm
kbd-2.2.0-2.azl3.x86_64.rpm
kbd-debuginfo-2.2.0-2.azl3.x86_64.rpm
kbd-2.2.0-3.azl3.x86_64.rpm
kbd-debuginfo-2.2.0-3.azl3.x86_64.rpm
kernel-cross-headers-6.6.150.1-1.azl3.noarch.rpm
kernel-headers-6.6.150.1-1.azl3.noarch.rpm
kmod-30-1.azl3.x86_64.rpm
Expand Down
Loading