diff options
| author | Daniel Golle | 2026-02-06 11:01:29 +0000 |
|---|---|---|
| committer | Daniel Golle | 2026-03-14 00:29:08 +0000 |
| commit | 858131356d2610f78bc8900c54a8bfcceec3586f (patch) | |
| tree | 1c593cfc114b4db4edc3ed0ffdbc8f1902491ad2 | |
| parent | 62654637114b68f16bfc10fbcc31bc075f92bf3a (diff) | |
hotplug-dispatch: fix filter disallowing setting PATH
Due to a bug in hotplug-dispatch, the PATH env variable wasn't
filtered, allowing authrorized callers the execution of commands
via PATH environment variable filter bypass.
Replace the call to strcmp with strncmp and limit the comparision
to 5 characters to account for each character in "PATH=".
Fixes: TOB-OWRT-4
Fixes: 08938fe ("procd: add hotplug-call dispatcher")
Reported-by: Trail of Bits (@trailofbits)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit e08cdc8562f55b9ac228a21f3f7605a18c522b81)
| -rw-r--r-- | hotplug-dispatch.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hotplug-dispatch.c b/hotplug-dispatch.c index 2bf150f..fc70750 100644 --- a/hotplug-dispatch.c +++ b/hotplug-dispatch.c @@ -232,7 +232,7 @@ static int hotplug_call(struct ubus_context *ctx, struct ubus_object *obj, if (!strncmp(enve, "LD_", 3)) continue; - if (!strcmp(enve, "PATH")) + if (!strncmp(enve, "PATH=", 5)) continue; if (strlen(enve) < 3) |