Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 26 Nov 2014 16:25:25 +0100
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: blkid command injection

Hi

There is a command injection inside blkid. It uses caching
files (/dev/.blkid.tab or /run/blkid/blkid.tab) to store info about the
UUID, LABEL etc it finds on certain devices.

However, it does not strip " character, so it can be confused to
build variable names containing embedded shell metas, which it would usually
encode inside the value.

Given an USB stick with /dev/sdb1 you can:

# mkfs.ext4 -L 'X"`/tmp/foo` "' /dev/sdb1
# blkid -o udev /dev/sdb1
ID_FS_LABEL=X__/tmp/foo___
[...]

Seems to be OK, but invoking blkid a second time, taking the cache in effect:

# blkid -o udev /dev/sdb1
ID_FS_LABEL=X
ID_FS_LABEL_ENC=X
ID_FS_`/tmp/foo` "" UUID=...
[...]


"blkid -o udev" is often used in root context via udev or in automounters
(uam-pmount) to construct key=value environment variables inside shell scripts
which are then evaluated.
Might be possible to construct an embedded LD_PRELOAD= as well for the binary
case.

By injecting > character one can probably construct whole fake cache entries.

Sebastian




-- 

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.