CVE-2013-2207

Vulnerability

CVE-2013-2207 is a privilege/ownership validation flaw in the pt_chown helper program included with the GNU C Library (glibc) before version 2.18. The program does not properly check permissions when changing the ownership and mode of pseudo-terminal (pty) slave device files, allowing a local user to modify the permissions on arbitrary tty files if they can present a FUSE file system that returns a different file system type than expected [2]. This oversight means that under specific conditions, the permission check intended to restrict which users can write to ptys can be bypassed.

Exploitation

An attacker must have local access to the system and be able to mount or trigger a FUSE file system. The exploit leverages the fact that pt_chown trusts the file system type reported by stat() without adequately verifying the permissions. By placing a pseudo-terminal device node on a FUSE file system and controlling the file system implementation, the attacker can cause pt_chown to change the ownership of the slave pty file to the attacker's user ID, or to make it world-writable [2]. No additional authentication is required beyond local shell access.

Impact

Successful exploitation allows the attacker to gain write access to a pseudo-terminal slave device that they should not normally control. This can lead to privilege escalation (e.g., hijacking another user's terminal session) or information disclosure by reading input from or injecting output into sessions of other users who rely on the same pseudo-terminal. In a shared system, this undermines the isolation enforced by the tty permission model [2].

Mitigation

The vulnerability is fixed in glibc version 2.18, released on August 12, 2013 [1]. Users should upgrade to glibc 2.18 or later. Gentoo Linux provides an updated package version 2.19-r1 or later to address this and other vulnerabilities [3]. No workaround is available other than applying the fix. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.