Messages in this thread | | | Date | Tue, 18 Dec 2012 22:02:23 +0000 | From | Alan Cox <> | Subject | Re: [PATCH v2] firmware: make sure paths remain relative |
| |
On Tue, 18 Dec 2012 13:04:49 -0800 Kees Cook <keescook@chromium.org> wrote:
> Some devices have configurable firmware locations. If these configuration > mechanisms are exposed to unprivileged userspace, it may be possible to > load firmware from an unexpected location. To minimize the risk of this, > make sure the string "../" does not appear in the firmware name. This > means that neither the users of request_firmware, nor the uevent handler > have to do this filtering themselves.
Have you verified no existing distribution ever does this ?
> + if (strstr(name, "../")) {
and this is obviously buggy and hasn't been tested
Hint foo/bar../baz
You need to check for ^../ /../ and /..$
Alan
| |