CVE-2023-46277: 
Rust vulnerability analysis and mitigation

CVE-2023-46277 affects the please (aka pleaser) software through version 0.5.4. The vulnerability allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl calls. The exploitation is only possible if both TIOCSTI and TIOCLINUX are not disabled on the system (RUSTSEC Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue affects both scenarios where root wants to drop privileges and when non-root users want to gain other privileges. The vulnerability can be exploited through the manipulation of TIOCSTI and TIOCLINUX ioctl calls to escalate privileges (NVD, GitLab Issue).

When successfully exploited, the vulnerability allows an attacker to execute commands with elevated privileges. For example, a command intended to run as a lower-privileged user (nobody) can be manipulated to run as the original user, effectively bypassing the intended privilege restrictions (GitLab Issue).

A fix has been proposed that involves starting new processes in a new PTY and inheriting STDIN/STDOUT/STDERR from the original one (GitLab MR). Additionally, modern Linux distributions often disable the TIOCSTI ioctl by default, which partially mitigates this vulnerability.