blob: 4e76067b3c59546f79641d92b627e2e76d0b9ff6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
Upstream-status: Backport
http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b
CVE-2014-9645 fix.
[YOCTO #7257]
Signed-off-by: Armin Kuster <akuster@mvista.com>
From 4e314faa0aecb66717418e9a47a4451aec59262b Mon Sep 17 00:00:00 2001
From: Denys Vlasenko <vda.linux@googlemail.com>
Date: Thu, 20 Nov 2014 17:24:33 +0000
Subject: modprobe,rmmod: reject module names with slashes
function old new delta
add_probe 86 113 +27
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---
Index: busybox-1.22.1/modutils/modprobe.c
===================================================================
--- busybox-1.22.1.orig/modutils/modprobe.c
+++ busybox-1.22.1/modutils/modprobe.c
@@ -238,6 +238,17 @@ static void add_probe(const char *name)
{
struct module_entry *m;
+ /*
+ * get_or_add_modentry() strips path from name and works
+ * on remaining basename.
+ * This would make "rmmod dir/name" and "modprobe dir/name"
+ * to work like "rmmod name" and "modprobe name",
+ * which is wrong, and can be abused via implicit modprobing:
+ * "ifconfig /usbserial up" tries to modprobe netdev-/usbserial.
+ */
+ if (strchr(name, '/'))
+ bb_error_msg_and_die("malformed module name '%s'", name);
+
m = get_or_add_modentry(name);
if (!(option_mask32 & (OPT_REMOVE | OPT_SHOW_DEPS))
&& (m->flags & MODULE_FLAG_LOADED)
|
