oss-sec mailing list archives
Re: blkid command injection
From: Sebastian Krahmer <krahmer () suse de>
Date: Mon, 15 Dec 2014 15:13:42 +0100
On Tue, Dec 02, 2014 at 12:22:04PM +0100, Sebastian Krahmer wrote:
On Fri, Nov 28, 2014 at 12:17:24AM +1100, Murray McAllister wrote:On 11/27/2014 02:25 AM, Sebastian Krahmer wrote:Hi There is a command injection inside blkid. It uses caching files (/dev/.blkid.tab or /run/blkid/blkid.tab) to store info about the UUID, LABEL etc it finds on certain devices. However, it does not strip " character, so it can be confused to build variable names containing embedded shell metas, which it would usually encode inside the value. Given an USB stick with /dev/sdb1 you can: # mkfs.ext4 -L 'X"`/tmp/foo` "' /dev/sdb1 # blkid -o udev /dev/sdb1 ID_FS_LABEL=X__/tmp/foo___ [...] Seems to be OK, but invoking blkid a second time, taking the cache in effect: # blkid -o udev /dev/sdb1 ID_FS_LABEL=X ID_FS_LABEL_ENC=X ID_FS_`/tmp/foo` "" UUID=... [...] "blkid -o udev" is often used in root context via udev or in automounters (uam-pmount) to construct key=value environment variables inside shell scripts which are then evaluated. Might be possible to construct an embedded LD_PRELOAD= as well for the binary case. By injecting > character one can probably construct whole fake cache entries. SebastianKarel Zak has committed a patch: https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdcThanks. Patch looks good to me. I contacted upstream about additional fixes which you might want to include as well, so we can release it alltogether. The severity of command injection is probably not that high that we need updates immediately.
FWIW, the issue in question can be found here: https://bugzilla.suse.com/show_bug.cgi?id=907434 Interesting for 32 bit systems where size_t has 32bit and so a mult of two 32bit words does not fit into the result. This would allow poor-man's badUSB attacks with lovely crafted GPT's because its probed via systemd/udev upon plugin. Thanks to Karel Zak for fixing a wrong > in the initial patch. Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team
Current thread:
- blkid command injection Sebastian Krahmer (Nov 26)
- Re: blkid command injection cve-assign (Nov 26)
- Re: blkid command injection Murray McAllister (Nov 27)
- Re: blkid command injection Sebastian Krahmer (Dec 02)
- Re: blkid command injection Sebastian Krahmer (Dec 15)
- Re: blkid command injection Sebastian Krahmer (Dec 02)