Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #84656 > unrolled thread

Bug#1087697: Mkinitramfs causes machines to fail booting when used with LD_LIBRARY_PATH

Back to article view | Back to linux.debian.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#1087697: Mkinitramfs causes machines to fail booting when used with LD_LIBRARY_PATH Ben Hutchings <ben@decadent.org.uk> - 2024-11-24 22:00 +0100

#84656 — Bug#1087697: Mkinitramfs causes machines to fail booting when used with LD_LIBRARY_PATH

[Multipart message — attachments visible in raw view] — view raw

On Sun, 17 Nov 2024 14:04:54 +0200 Matan Liber <matan@pentera.io>
wrote:
> Package: initramfs-tools
> Version: 0.136ubuntu6.7
> 
> vulnerability identified in mkinitramfs that could lead to a Denial
of
> Service (DoS) condition on affected systems. Using mkinitramfs with
> the environment variable LD_LIBRARY_PATH causes machines to fail boot
> due to missing libraries in the initramfs images. A full report is
> attached.

This isn't a security vulnerability.  If an attacker can control
LD_LIBRARY_PATH for a user session then they can already cause
arbitrary code to be run as that user.

I may address this as an issue of robustness, but it's not going to
have a high priority.

Ben.

-- 
Ben Hutchings
Any smoothly functioning technology is indistinguishable
from a rigged demo.

[toc] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web