Re: systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's terminals

[Aaron Rainbolt <arraybolt3 () riseup net>]

On Tue, 7 Apr 2026 20:09:06 -0400
Aaron Rainbolt <arraybolt3 () riseup net> wrote:

> Going over this semi-briefly:
>   
> * systemd-journald is configured with the `ForwardToWall=yes` and
>   `MaxWallLevel=emerg` settings by default in Ubuntu 26.04 pre-release
>   images and Arch Linux. (I think this is because these are enabled by
>   default in systemd upstream but haven't tried to verify this.) In my
>   testing, this will result in systemd-journald copying emerg-level
>   log messages to all logged-in TTYs and at least some root-owned PTYs
>   (if any exist).
> * Any user on the system can write an emerg-level log message using
>   `logger -p emerg 'msg...'`.
> * Potentially dangerous character sequences in log messages (like ANSI
>   escape sequences) are not sanitized by systemd-journald before it
>   prints those messages to other user's terminals.
> * Therefore, one can use systemd-journald to write malicious things to
>   other people's terminals, which can be used to exploit terminal
>   emulator vulnerabilities. There have been vulnerabilities in
>   terminal emulators like XTerm in the past that would allow this to
>   be used to execute arbitrary code as root if someone is unlucky
>   enough to have a PTY to a root shell open in a vulnerable terminal
>   when an attacker writes their malicious log message.

Someone (not sure who) did the kind service of getting a CVE assigned
for this: https://www.cve.org/CVERecord?id=CVE-2026-40228 To whoever
that was, thank you :)

--
Aaron

Attachment: _bin
Description: OpenPGP digital signature