My Rust TUI Let Any Local User Write to My Terminal

Описание и применение

В любой локальной системе пользователь может изменить название процесса, команду или журнал, вставив управляющие последовательности терминала, что приводит к нежелательным действиям терминала. В версии 0.3.0 добавлена очистка всех выводимых строк от управляющих символов и корректная обработка не‑UTF‑8 названий процессов.

Задача

Any local user can inject terminal escape sequences into tuxctl’s output by setting a process name, command line, or journal message containing control characters, causing unintended terminal actions such as clipboard writes or resets.

Результат

The vulnerability allowed local users to inject terminal escape sequences via process names, command lines, or journal messages. The fix sanitizes all output and handles non‑UTF‑8 names, preventing unintended terminal actions.

Рабочий процесс

• Identify that process names, command lines, and journal messages can contain arbitrary bytes.
• Observe that Ratatui removes only newlines, so ESC bytes reach the terminal.
• Realize that any local user can set a process name via prctl or a command line, or write a journal message with logger.
• Run a demo script that sets a process name to an escape sequence that changes the terminal title.
• Perform a security review of v0.3.0, discovering the bug and a second bug where non‑UTF‑8 names were dropped.
• Implement sanitization of all drawn text and lossless reading of /proc/<pid>/stat.
• Release v0.3.0 with the fixes and no new dependencies.
• Provide a checklist for TUI/CLI developers to avoid similar issues.
• Advise users to upgrade to v0.3.0 or later.

Доказательства

any local user could make tuxctl write arbitrary bytes to my terminal

Источник

When Ratatui renders a span, it removes newline characters and nothing else.

Источник

v0.3.0 now removes control characters and bidirectional overrides from everything tuxctl draws.

Источник

For the second bug, /proc/<pid>/stat is now read lossily.

Источник