If an unprivileged process maintains an open file descriptor to a TTY after the previous user session has logged out and the TTY device ownership has reverted to root or another privileged user, openvt -u can be manipulated into incorrectly attributing the TTY to the privileged owner. This bypasses authentication, allowing the tool to execute a passwordless login, such as login -f root, on the spawned VT. This vulnerability is specifically reachable in deployments using openvt via privileged kbrequest or init paths.

Impact

Successful exploitation allows an unprivileged local user to obtain a root shell or login as another privileged user without credentials. This affects systems where openvt is configured in a privileged execution flow, such as through system initialization scripts or keyboard request handlers.

Recommendation

• Monitor system logs and process execution for openvt commands, specifically those utilizing the -u or -us flags.
• Audit kbrequest and init configurations to identify if openvt is executed with elevated privileges.
• Update util-linux packages to the vendor-provided security patch once available to remediate the authenticate_user() logic flaw.
• Restrict local user access to terminal device nodes where possible to prevent unprivileged processes from maintaining descriptors after session termination.