A vulnerability (CVE-2025-29906) has been identified in the finit init system, allowing access as any user without password verification. Exploitation of the vulnerability occurs through manipulation of the login prompt and requires console access. The vulnerability is present from version 3.0 (October 2017) and has been fixed in release finit 4.11. Following that, release 4.12 has been formed addressing a buffer overflow in the urandom plugin, which is not noted as a vulnerability.
The vulnerability affects the implementation of the getty program, which displays the login prompt in the terminal and initiates the /bin/login process for user authentication. The vulnerability is caused by a lack of argument separation in the command line when launching /bin/login, allowing the option '-f' in the username to bypass password checking (for example, entering '-f root' instead of 'root'). This issue has been resolved by adding the argument '—' before the username field: — execl(_PATH_LOGIN, _PATH_LOGIN, "-p", name, NULL); + execl(_PATH_LOGIN, _PATH_LOGIN, "-p", "—", name, NULL);
As a workaround to block the vulnerability, it is recommended to use an external implementation of the getty process in finit, such as agetty. In the Debian 12, Ubuntu, Parrot, Raspbian, and Trisquel distributions, the finit packages remain unpatched for this vulnerability.
The Finit (Fast init) initialization system is developed as a simple alternative to SysV init and systemd, and has gained traction in embedded systems. The project is based on the fastinit initialization technology used in the Linux firmware of EeePC netbooks, noted for its very fast boot process. Finit supports SysV init-style runlevels, automatic service restarts in case of failure, execution of one-off handlers, starting services while considering dependencies and arbitrary conditions, attaching additional handlers to run before or after service execution, extending functionality through plugins, and configuring limits using Cgroups v2.
Source: opennet.ru
