runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "binary_version": "1:2.31.1-0.4ubuntu3.3", "binary_name": "bsdutils" }, { "binary_version": "1:2.31.1-0.4ubuntu3.3", "binary_name": "bsdutils-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "fdisk" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "fdisk-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "fdisk-udeb" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libblkid-dev" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libblkid1" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libblkid1-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libblkid1-udeb" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libfdisk-dev" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libfdisk1" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libfdisk1-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libfdisk1-udeb" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libmount-dev" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libmount1" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libmount1-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libmount1-udeb" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libsmartcols-dev" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libsmartcols1" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libsmartcols1-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libsmartcols1-udeb" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libuuid1" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libuuid1-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "libuuid1-udeb" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "mount" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "mount-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "rfkill" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "rfkill-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "setpriv" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "setpriv-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "util-linux" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "util-linux-dbgsym" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "util-linux-locales" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "util-linux-udeb" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "uuid-dev" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "uuid-runtime" }, { "binary_version": "2.31.1-0.4ubuntu3.3", "binary_name": "uuid-runtime-dbgsym" } ] }