Date: Wed, 26 Nov 2014 12:16:55 -0500 (EST) From: cve-assign@...re.org To: krahmer@...e.de Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: blkid command injection -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > There is a command injection inside blkid. > > Given an USB stick with /dev/sdb1 you can: ... > > ID_FS_`/tmp/foo` "" UUID=... > > "blkid -o udev" is often used in root context via udev or in automounters > (uam-pmount) to construct key=value environment variables inside shell scripts > which are then evaluated. Use CVE-2014-9114. It seems fairly clear that "blkid -o udev" is attempting to create lines that are safe sh input. Or, more specifically, the expectation is that the lines would be directly usable. We currently don't see a reasonable alternative interpretation that blkid is simply attempting to provide output lines that accurately reflect strings found on device media, and is expecting that other components will make a security determination about each line, before using that line as sh input. Also, the blkid maintainer has apparently made other changes relating to quoting of strings found on device media: http://git.kernel.org/cgit/utils/util-linux/util-linux.git/commit/?id=1c9885cde853a458b5abe5ce0804abc27caf4fd4 (we understand that it's not completely analogous). Finally, http://git.kernel.org/cgit/utils/util-linux/util-linux.git/tree/misc-utils/blkid.8 says 'print key="value" pairs for easy import into the udev environment' and those security determinations would probably not be considered "easy import." - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJUdgo0AAoJEKllVAevmvms/vEH/Rt5DBzngbJz8CFPoomJbQyv NSK59hcK0iWcvEf62RVRfD3S1jvqSUGZeFIILujK0vOrEMbiuyyqgKUjqnarcF8W ofwEonzPQofKjaT5TmrlGjuhSCJcyM8VrD4yg4ctGfIWcr4MID6BoPUC4T2wLxq6 8z4T2dfa8FhOlCDO7WcjQGX0N72tbc9ptD5ISCo7QiPJdkX8mdlABariB5u9FTap /FoBfwlx+/R64grEqvHB7SM4DKqJLE/6OBOVuESIDeh32uIPtZ69Y+gM7t5h6H2E Tq232BVj9+uvdJsFouWxDMi/GXWeCqrcrTIa6EvuepKJ5a7LcWi/UJvswzQvsy8= =1Rws -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.