[lkml]   [2004]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: information leak in vga console scrollback buffer
    On Sun, 13 Jun 2004, Kalin KOZHUHAROV wrote:

    > OK, I think I got what you are trying to point out.
    > To reproduce:
    > 1. login to a (vga) console.
    > 2. less /etc/services; press space t oscroll a few screens
    > 3. logout
    > 4. login again on the same console (possibly as a different user)
    > 5. less /etc/resolv.conf
    > 6. press UpArrow, then Shift+PgUp
    > What is expected:
    > screen should not scroll past your file.
    > What happens:
    > You can view the previous text (from /etc/services)!!!

    Here you didn't clear the scrollback buffer. Maybe you (or getty) executed
    a clear or a terminal reset but that only affects the visible part and not
    the scrollback buffer. There's absolutely no problem so far since everyone
    knows that the scrollback buffer only disappears when you switch to a
    different console.

    My problem is that with a really-not-trivial-command-and-key-combination
    you can possibly see /etc/services (in your example) even _after_ you've
    switched to a different console and you are certain that the scrollback
    buffer is no longer available.

    And then what if it's not /etc/services but some private data of yours?
    Maybe other users can later access it. There's no way you can protect
    yourself against it. And you live in a false belief that your private data
    is scrolled out forever.

    Please forget your own test case. Repeat _exactly_ those steps _I_
    described in my original post. Then you'll understand what I'm talking

    You sure won't understand my problem if you believe that I'm wrong and
    want to convience me with your own interpretation of my words and your own
    (completely different) test case. Please stick to exactly what I reported.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:03    [W:0.021 / U:2.564 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site