Discussion
Loading...

Post

  • About
  • Code of conduct
  • Privacy
  • Users
  • Instances
  • About Bonfire
jomo
@jomo@mstdn.io  ·  activity timestamp 4 days ago

FYI: The sudo-rs bug of leaking passwords on timeout is a general problem of line buffered stdin streams.

The `read` builtin suffers from the same problem.

https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw

#sudors #sudo_rs #bash #CVE_2025_64170 #infosec

GitHub

Partial password reveal when password timeout occurs

### Summary When typing partial passwords but not pressing return for a long time, a password timeout can occur. When this happens, the keys pressed are replayed onto the console. ### Example ...
Your browser does not support the video tag.
GIF
GIF
Video of a shell showing the command `read -t 5 -s password || echo timed out`. After 5 seconds, "timed out" is printed and the previously invisible "s3cr3t!" is printed after the prompt string on the next line.
Video of a shell showing the command `read -t 5 -s password || echo timed out`. After 5 seconds, "timed out" is printed and the previously invisible "s3cr3t!" is printed after the prompt string on the next line.
  • Copy link
  • Flag this post
  • Block
jomo
@jomo@mstdn.io replied  ·  activity timestamp 4 days ago

This issue occurs when using a line buffer, where the input is only placed into the buffer after a newline character was entered. When that character is not entered, the data is not read, and thus not flushed from stdin and is still waiting to be read by the next program (such as the shell) to read from the stdin buffer. Bash uses a character buffer to read your keyboard inputs, so the data is displayed immediately.

  • Copy link
  • Flag this comment
  • Block
Log in

bonfire.cafe

A space for Bonfire maintainers and contributors to communicate

bonfire.cafe: About · Code of conduct · Privacy · Users · Instances
Bonfire social · 1.0.0 no JS en
Automatic federation enabled
  • Explore
  • About
  • Members
  • Code of Conduct
Home
Login