runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
{ "binaries": [ { "binary_version": "1:2.27.1-6ubuntu3.10+esm2", "binary_name": "bsdutils" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "libblkid-dev" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "libblkid1" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "libfdisk-dev" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "libfdisk1" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "libmount-dev" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "libmount1" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "libsmartcols-dev" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "libsmartcols1" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "libuuid1" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "mount" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "util-linux" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "util-linux-locales" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "uuid-dev" }, { "binary_version": "2.27.1-6ubuntu3.10+esm2", "binary_name": "uuid-runtime" } ] }