CVE-2014-9114
CVE-2014-9114
| Published Date | 2017-03-31 |
|---|---|
| Product | centos |
| Severity | High (7.8) |
| Component | util |
| Affected Versions | CentOS 7 |
| Patched Versions | util-linux-2.23.2-65_ol001.el7_9.1 |
CVE Details
OL CVE Issue Summary
Security Center info:
libblkid stores block-device probing results in /run/blkid/blkid.tab using an XML-like cache format:
<device NAME="value" ...>devname
The cache writer (libblkid/src/save.c) did NOT escape " or \\ inside tag values, so a filesystem label containing a double-quote (e.g. mkfs.ext4 -L 'AAA"BBB') produced a malformed cache entry:
<device ... LABEL="AAA"BBB" ...>/dev/sdb1 This caused incorrect blkid output and enabled shell command injection when applications used:
eval $(blkid -o export /dev/sdb1)
Additionally, blkid(8) --output export mode called safe_print() with no escape-character set, so the label value was written verbatim to stdout --making shell injection via eval practical.