CVE-2016-2856

Vulnerability

The pt_chown utility in the GNU C Library (glibc) before 2.19-18+deb8u4 on Debian jessie, before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS, before 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS, before 2.21-0ubuntu4.2 on Ubuntu 15.10, and before 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10 lacks a namespace check when changing ownership of /dev/pts slave ptys. It uses ptsname() to get the slave path, which relies on a TIOCGPTN ioctl on the master file descriptor. This allows an attacker in a user namespace to create a new devpts mount with newinstance, create master/slave pairs until a number overlaps with a target pty on the host, then invoke pt_chown to gain ownership of that host pty [1][3]. The vulnerability is not considered an upstream issue because the upstream documentation advises against enabling --enable-pt_chown [2].

Exploitation

A local attacker needs the ability to create a user namespace, mount a new devpts instance with the newinstance option, and create pty pairs until the slave number collides with a target pty on the host (e.g., /dev/pts/0). The attacker then runs the setuid pt_chown binary while holding the master file descriptor of the colliding pty from within the namespace. pt_chown performs chown on the slave path, changing its ownership to the attacker's real user ID, thereby transferring control of the target pty [1][3]. No authentication or additional privileges are required beyond the ability to create user namespaces, which is available to unprivileged users on affected systems.

Impact

Upon successful exploitation, the attacker can read keystrokes typed on the compromised terminal and inject fake output, effectively intercepting all terminal I/O for that session. This can lead to disclosure of sensitive information (e.g., passwords) and potentially privilege escalation if the attacker controls a root shell or gains access to a privileged account [1][2][3]. The attack is local and requires low privileges to execute.

Mitigation

Affected Ubuntu systems are fixed in USN-2985-1 and USN-2985-2 (with a regression fix) [4]. For Debian, the fix is included in glibc version 2.19-18+deb8u4 for jessie. Upstream recommends not using the --enable-pt_chown option; disabling pt_chown (e.g., removing the setuid bit or removing the binary) is an effective workaround. The vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.