2022-09-22 10:45:37

by CGEL

Subject: [PATCH linux-next] scripts/extract_xc3028: use absolute path for which

From: Xu Panda <[email protected]>

Not using absolute path when invoking which can lead to serious security
issues.

Reported-by: Zeal Robot <[email protected]>
Signed-off-by: Xu Panda <[email protected]>
---
scripts/extract_xc3028.pl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/extract_xc3028.pl b/scripts/extract_xc3028.pl
index e1c9af25a595..c9ddcba07550 100755
--- a/scripts/extract_xc3028.pl
+++ b/scripts/extract_xc3028.pl
@@ -29,7 +29,7 @@ sub verify ($$)
my ($filename, $hash) = @_;
my ($testhash);

- if (system("which md5sum > /dev/null 2>&1")) {
+ if (system("/usr/bin/which md5sum > /dev/null 2>&1")) {
die "This firmware requires the md5sum command - see http://www.gnu.org/software/coreutils/\n";
}

--
2.15.2

2022-09-22 11:33:02

by Conor Dooley

Subject: Re: [PATCH linux-next] scripts/extract_xc3028: use absolute path for which

On Thu, Sep 22, 2022 at 10:26:25AM +0000, [email protected] wrote:
> From: Xu Panda <[email protected]>

Hey Xu Panda,
I accidentally found this patch while looking for your RISC-V one on
lore.

You've not CC'ed any maintainers so I am not sure who you expect to pick
this patch up, but seeing as Greg has NACKed the patch you sent to the
RISC-V list [0] earlier doing the same thing I figure it is a moot
point... maybe engaging with maintainers rather than sending more
patches would be a more successful strategy for you here :(

Either way, you'll likely have to resend this with a maintainer CCed for
someone to be able to apply your patch once you've resolved the email
issues.

Thanks,
Conor.

0 - https://lore.kernel.org/all/[email protected]/
>
> Not using absolute path when invoking which can lead to serious security
> issues.
>
> Reported-by: Zeal Robot <[email protected]>
> Signed-off-by: Xu Panda <[email protected]>
> ---
> scripts/extract_xc3028.pl | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/scripts/extract_xc3028.pl b/scripts/extract_xc3028.pl
> index e1c9af25a595..c9ddcba07550 100755
> --- a/scripts/extract_xc3028.pl
> +++ b/scripts/extract_xc3028.pl
> @@ -29,7 +29,7 @@ sub verify ($$)
> my ($filename, $hash) = @_;
> my ($testhash);
>
> - if (system("which md5sum > /dev/null 2>&1")) {
> + if (system("/usr/bin/which md5sum > /dev/null 2>&1")) {
> die "This firmware requires the md5sum command - see http://www.gnu.org/software/coreutils/\n";
> }
>
> --
> 2.15.2
>