7180 2015-01-19 08:16:44 +0000 util-linux: command injection flaw in blkid, CVE-2014-9114 2015-03-25 01:51:42 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core unspecified x86 Multiple RESOLVED FIXED Medium normal 1.8 M4 1 sona.sarmadi Qi.Chen meta.mr.watcher meta.watcher --- --- No (bug/feature does not impact docs) oldest_to_newest 48021 0 sona.sarmadi 2015-01-19 08:16:44 +0000 Sebastian Krahmer (Security Engineer at SuSE)reported a command injection flaw in blkid. This could possibly result in command execution with root privileges (for example, when running blkid on a malicious USB drive): http://www.openwall.com/lists/oss-security/2014/11/26/13 Fixed in upstream tree, commit: https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc References: https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc http://www.openwall.com/lists/oss-security/2014/11/26/13 https://bugzilla.redhat.com/show_bug.cgi?id=1168485 https://security-tracker.debian.org/tracker/CVE-2014-9114 48117 1 Qi.Chen 2015-01-21 06:40:53 +0000 I'll check whether it's fixed in the new stable version. If not, I'll send out a patch once the util-linux upgrade patch is merged. //Chen Qi 49363 2 Qi.Chen 2015-03-11 02:50:35 +0000 The problem is fixed upstream. Upgrading util-linux to 2.26 would solve this problem. As upgrading packages is considered as a feature, at this moment, I'm going to backport the corresponding patch to fix this problem. //Chen Qi 49718 3 Qi.Chen 2015-03-25 01:51:42 +0000 Module: openembedded-core.git Branch: master Commit: 6a5c24f22621f41b17267a6ebedecec631d0156d URL: http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=6a5c24f22621f41b17267a6ebedecec631d0156d