[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 2 Dec 2014 12:22:04 +0100
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: blkid command injection
On Fri, Nov 28, 2014 at 12:17:24AM +1100, Murray McAllister wrote:
> On 11/27/2014 02:25 AM, Sebastian Krahmer wrote:
>> Hi
>>
>> There is a command injection inside blkid. It uses caching
>> files (/dev/.blkid.tab or /run/blkid/blkid.tab) to store info about the
>> UUID, LABEL etc it finds on certain devices.
>>
>> However, it does not strip " character, so it can be confused to
>> build variable names containing embedded shell metas, which it would usually
>> encode inside the value.
>>
>> Given an USB stick with /dev/sdb1 you can:
>>
>> # mkfs.ext4 -L 'X"`/tmp/foo` "' /dev/sdb1
>> # blkid -o udev /dev/sdb1
>> ID_FS_LABEL=X__/tmp/foo___
>> [...]
>>
>> Seems to be OK, but invoking blkid a second time, taking the cache in effect:
>>
>> # blkid -o udev /dev/sdb1
>> ID_FS_LABEL=X
>> ID_FS_LABEL_ENC=X
>> ID_FS_`/tmp/foo` "" UUID=...
>> [...]
>>
>>
>> "blkid -o udev" is often used in root context via udev or in automounters
>> (uam-pmount) to construct key=value environment variables inside shell scripts
>> which are then evaluated.
>> Might be possible to construct an embedded LD_PRELOAD= as well for the binary
>> case.
>>
>> By injecting > character one can probably construct whole fake cache entries.
>>
>> Sebastian
>>
>>
>>
>>
>
> Karel Zak has committed a patch:
>
> https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc
>
Thanks. Patch looks good to me. I contacted upstream about additional
fixes which you might want to include as well, so we can release it alltogether. The
severity of command injection is probably not that high that we need
updates immediately.
Sebastian
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
