CVE-2025-29906: Finit Authentication Bypass Vulnerability

CVE-2025-29906 Overview

Finit is a fast init system for Linux that replaces traditional SysV init and systemd-style supervisors. The project ships a bundled implementation of getty used by the tty configuration directive. In versions starting from 3.0-rc1 and prior to 4.11, this bundled getty bypasses /bin/login, allowing a user to log in as any account without authentication. The flaw is tracked as an improper authentication weakness [CWE-287] and affects systems that configure TTY consoles through Finit. The maintainer addressed the issue in version 4.11.

Critical Impact
Local attackers with console access can authenticate as any user, including root, without supplying credentials, resulting in full system compromise.

Affected Products

Finit versions 3.0-rc1 through 4.10
Linux systems using Finit's tty directive with the bundled getty
Embedded and appliance Linux distributions shipping vulnerable Finit builds

Discovery Timeline

2025-04-29 - CVE-2025-29906 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-29906

Vulnerability Analysis

Finit exposes a tty directive that attaches a login prompt to a serial console or virtual terminal. To reduce dependencies in minimal Linux environments, Finit bundles its own getty implementation rather than invoking the system agetty or mingetty binary. The bundled implementation accepts a username at the prompt but fails to hand the session off to /bin/login for credential verification. As a result, the entered username is granted an interactive shell with that account's privileges. An attacker with physical or remote console access (for example, via a serial port, IPMI Serial-over-LAN, or virtual console) can enter root and receive a root shell. The vulnerability is classified under [CWE-287] Improper Authentication.

Root Cause

The bundled getty code path omits the call to /bin/login, which is the component responsible for invoking PAM, validating passwords, enforcing account restrictions, and applying session policy. By skipping this step, Finit effectively treats any submitted username as authenticated.

Attack Vector

Exploitation requires local access to a TTY managed by Finit's bundled getty. The attacker connects to the console, types any valid username at the login prompt, and receives a shell as that user. No password, key, or token is required. Refer to the GitHub Security Advisory GHSA-563g-p98j-mc9q and the upstream commit for the corrected logic.

Detection Methods for CVE-2025-29906

Indicators of Compromise

Interactive shell sessions originating from a TTY without a preceding successful pam_unix authentication event in /var/log/auth.log or journalctl.
Root or privileged shells spawned directly by the finit process tree rather than by /bin/login.
Unexpected process ancestry where user shells have finit or its bundled getty as the parent process.

Detection Strategies

Inventory installed Finit versions across Linux hosts and flag any release between 3.0-rc1 and 4.10.
Audit /etc/finit.conf and /etc/finit.d/ for tty directives that rely on Finit's built-in getty.
Correlate console login events with PAM authentication records to identify logins that never traversed /bin/login.

Monitoring Recommendations

Forward auth.log, wtmp, and systemd journal data to a centralized log platform for review of TTY session establishment.
Alert on root shells whose process lineage does not include login or sshd.
Track configuration changes to Finit unit files in version control or with file integrity monitoring.

How to Mitigate CVE-2025-29906

Immediate Actions Required

Upgrade Finit to version 4.11 or later on all affected Linux systems.
Restrict physical and out-of-band console access (serial, IPMI, virtual KVM) until patches are applied.
Review recent console login activity for unauthorized access to privileged accounts.

Patch Information

The maintainer fixed the issue in Finit 4.11. The corrective change is published in the Finit commit 6528628b and documented in the GitHub Security Advisory GHSA-563g-p98j-mc9q. Distribution maintainers shipping Finit should rebase packages onto 4.11.

Workarounds

Replace Finit's bundled getty invocation by configuring the tty directive to launch an external getty such as agetty or mingetty, which delegates to /bin/login.
Disable unused TTY entries in /etc/finit.conf to reduce exposed login surfaces.
Enforce console access controls through hardware (locked racks) and management plane ACLs on IPMI and BMC interfaces.

bash

# Configuration example: replace bundled getty with agetty in finit.conf
# Vulnerable (uses Finit's built-in getty):
# tty [12345] /dev/ttyS0 115200 noclear

# Mitigated (delegates to agetty, which calls /bin/login):
tty [12345] /sbin/agetty -L 115200 ttyS0 vt100