Finit Getty Configuration Bypass Vulnerability Allowing Unauthenticated Login

A vulnerability in Finit, a fast init system for Linux, has been identified in versions from 3.0-rc1 prior to 4.11. The issue arises because the bundled implementation of getty for the 'tty' configuration directive can bypass the standard login process. This allows users to log in as any user without authentication. The vulnerability has been patched in version 4.11.

Impact

Exploitation of this vulnerability allows for unauthenticated login as any user, bypassing the normal authentication process.

Remediation

Users can upgrade to Finit version 4.11 or later, or use an external getty such as agetty from their distribution.