unsafe printk
Suppose I name an executable this:
"\n<0>Oops: EIP=0"
That comes out as a KERN_EMERG log message, hitting the console and maybe a pager even.
There seem to be a number of places in the kernel that printk current->comm without concern for what it may contain.
Escape codes and non-ASCII can make for some interesting log messages as well. Terminals may have some programmable keys or answerback messages. So one day root is using grep on the log files, and they program the answerback string to contain a "\r\nrm -r /\r\n"...
BTW, the 0x9b character is often an escape.
Hi!
Quoted 10 lines
Suppose I name an executable this:
"\n<0>Oops: EIP=0"That comes out as a
KERN_EMERGlog message, hitting the console and maybe a pager even.There seem to be a number of places in the kernel that printk
current->commwithout concern for what it may contain.
Quoted 6 lines
Escape codes and non-ASCII can make for some interesting log messages as well. Terminals may have some programmable keys or answerback messages. So one day root is using grep on the log files, and they program the answerback string to contain a "\r\nrm -r /\r\n"...
Or at least you can make his terminal pink ;-). Unfortunately same problem is with userland programs; root does ps and his terminal goes pink. Sanitizing kernel messages would be good start, but ps&friends and ls&friends need to be sanitized, too.
Pavel
Signature · 2 lines
When do you have a heart between your knees? [Johanka's followup: and *two* hearts?]
Quoted 10 lines · Albert Cahalan
Suppose I name an executable this:
"\n<0>Oops: EIP=0"That comes out as a
KERN_EMERGlog message, hitting the console and maybe a pager even.There seem to be a number of places in the kernel that printk
current->commwithout concern for what it may contain.
Quoted 8 lines
Escape codes and non-ASCII can make for some interesting log messages as well. Terminals may have some programmable keys or answerback messages. So one day root is using grep on the log files, and they program the answerback string to contain a "\r\nrm -r /\r\n"...
BTW, the
0x9bcharacter is often an escape.
I remember this from VAX/VMS "system manager school"! "Don't ever read anybody's data from the SYSTEM account...."
The text read could write a whole command-procedure to the answer-back buffer, then tell it to answer-back! The result would be the execution of anything from a privileged account.
I don't think the built-in VT100-220 emulation has an answer-back buffer, but there still are RS-232C terminals out there........
Cheers,
Dick Johnson
Penguin : Linux version 2.4.22 on an i686 machine (797.90 BogoMips).
Note 96.31% of all statistics are fiction.
Quoted 19 lines · Pavel Machek
Hi!
Quoted 10 lines
Suppose I name an executable this:
"\n<0>Oops: EIP=0"That comes out as a
KERN_EMERGlog message, hitting the console and maybe a pager even.There seem to be a number of places in the kernel that printk
current->commwithout concern for what it may contain.Quoted 6 lines
Escape codes and non-ASCII can make for some interesting log messages as well. Terminals may have some programmable keys or answerback messages. So one day root is using grep on the log files, and they program the answerback string to contain a "\r\nrm -r /\r\n"...
Quoted 4 lines
Or at least you can make his terminal pink ;-). Unfortunately same problem is with userland programs; root does ps and his terminal goes pink. Sanitizing kernel messages would be good start, but ps&friends and ls&friends need to be sanitized, too.
Both ps and ls are protected. At least with the procps-3.1.xx code, w and top are also protected.
So anyway, what to do about the kernel messages? One option is to just mangle comm up front. Another option is to provide a formatting function for safe printing.