| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 9 Oct 2014 13:57:03 -0400 From: Peter Foley <pefoley2@...oley.com> To: linux-kernel@...r.kernel.org Cc: foxwilson123@...il.com, mmarek@...e.cz, fbuihuu@...il.com, linux-kbuild@...r.kernel.org, Peter Foley <pefoley2@...oley.com> Subject: [PATCH] scripts: don't source auto.conf for LOCALVERSION setlocalversion currently sources auto.conf to get a value for CONFIG_LOCALVERSION. This interprets auto.conf as a bash script, causing CONFIG_LOCALVERSION="`rm -rf --no-preserve-root /`" to actually execute the command inside the backticks when setlocalversion is called. While the possibility of something like this happening is remote, use sed to avoid potential harm from untrusted .config files. Reported-by: Fox Wilson <foxwilson123@...il.com> Signed-off-by: Peter Foley <pefoley2@...oley.com> --- scripts/setlocalversion | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/setlocalversion b/scripts/setlocalversion index 63d91e2..5b00123 100755 --- a/scripts/setlocalversion +++ b/scripts/setlocalversion @@ -141,7 +141,7 @@ if $scm_only; then fi if test -e include/config/auto.conf; then - . include/config/auto.conf + CONFIG_LOCALVERSION=$(sed -n 's/CONFIG_LOCALVERSION="\(.*\)"/\1/p' include/config/auto.conf) else echo "Error: kernelrelease not valid - run 'make prepare' to update it" exit 1 -- 2.1.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists