Bug#1087697: Mkinitramfs causes machines to fail booting when used with LD_LIBRARY_PATH

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#1087697: Mkinitramfs causes machines to fail booting when used with LD_LIBRARY_PATH
Date	2024-11-24 22:00 +0100
Message-ID	<JMrS1-bjB7-1@gated-at.bofh.it> (permalink)
References	<JJMgh-9xPr-7@gated-at.bofh.it> <JJMgh-9xPr-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Sun, 17 Nov 2024 14:04:54 +0200 Matan Liber <matan@pentera.io>
wrote:
> Package: initramfs-tools
> Version: 0.136ubuntu6.7
> 
> vulnerability identified in mkinitramfs that could lead to a Denial
of
> Service (DoS) condition on affected systems. Using mkinitramfs with
> the environment variable LD_LIBRARY_PATH causes machines to fail boot
> due to missing libraries in the initramfs images. A full report is
> attached.

This isn't a security vulnerability.  If an attacker can control
LD_LIBRARY_PATH for a user session then they can already cause
arbitrary code to be run as that user.

I may address this as an issue of robustness, but it's not going to
have a high priority.

Ben.

-- 
Ben Hutchings
Any smoothly functioning technology is indistinguishable
from a rigged demo.

Back to linux.debian.kernel | Previous | Next | Find similar | Unroll thread

Thread

Bug#1087697: Mkinitramfs causes machines to fail booting when used with LD_LIBRARY_PATH Ben Hutchings <ben@decadent.org.uk> - 2024-11-24 22:00 +0100

csiph-web