Bug 7180

Summary:	util-linux: command injection flaw in blkid, CVE-2014-9114
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Sona Sarmadi <sona.sarmadi>
Component:	core	Assignee:	Chen Qi <Qi.Chen>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Medium	CC:	meta.mr.watcher, meta.watcher
Version:	unspecified
Target Milestone:	1.8 M4
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)

Description Sona Sarmadi 2015-01-19 08:16:44 UTC

Sebastian Krahmer (Security Engineer at SuSE)reported a command injection flaw in blkid. This could possibly result in command execution with root privileges (for example, when running blkid on a malicious USB drive):

http://www.openwall.com/lists/oss-security/2014/11/26/13


Fixed in upstream tree, commit:
https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc

References:
https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc
http://www.openwall.com/lists/oss-security/2014/11/26/13

https://bugzilla.redhat.com/show_bug.cgi?id=1168485
https://security-tracker.debian.org/tracker/CVE-2014-9114

Comment 1 Chen Qi 2015-01-21 06:40:53 UTC

I'll check whether it's fixed in the new stable version.
If not, I'll send out a patch once the util-linux upgrade patch is merged.

//Chen Qi

Comment 2 Chen Qi 2015-03-11 02:50:35 UTC

The problem is fixed upstream.
Upgrading util-linux to 2.26 would solve this problem.
As upgrading packages is considered as a feature, at this moment, I'm going to backport the corresponding patch to fix this problem.

//Chen Qi

Comment 3 Chen Qi 2015-03-25 01:51:42 UTC

Module: openembedded-core.git
Branch: master
Commit: 6a5c24f22621f41b17267a6ebedecec631d0156d
URL:    http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=6a5c24f22621f41b17267a6ebedecec631d0156d