[CVE] Arbitrary command execution in the removable device notifier
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Kubuntu PPA |
Fix Released
|
High
|
Simon Quigley | ||
Artful |
Fix Released
|
High
|
Simon Quigley | ||
Xenial |
Fix Released
|
High
|
Simon Quigley | ||
plasma-workspace (Ubuntu) |
Fix Released
|
High
|
Rik Mills | ||
Xenial |
Fix Released
|
High
|
Simon Quigley | ||
Artful |
Fix Released
|
High
|
Simon Quigley | ||
Bionic |
Fix Released
|
High
|
Rik Mills |
Bug Description
KDE Project Security Advisory
=======
Title: Plasma Desktop: Arbitrary command execution in the removable device notifier
Risk Rating: High
CVE: CVE-2018-6791
Versions: Plasma < 5.12.0
Date: 8 February 2018
Overview
========
When a vfat thumbdrive which contains `` or $() in its volume label is plugged
and mounted trough the device notifier, it's interpreted as a shell command,
leaving a possibility of arbitrary commands execution. an example of offending
volume label is "$(touch b)" which will create a file called b in the
home folder.
Workaround
==========
Mount removable devices with Dolphin instead of the device notifier.
Solution
========
Update to Plasma >= 5.12.0 or Plasma >= 5.8.9
Or apply the following patches:
Plasma 5.8:
https:/
Plasma 5.9/5.10/5.11:
https:/
Credits
=======
Thanks to ksieluzyckih for the report and to Marco Martin for the fix.
CVE References
Changed in plasma-workspace (Ubuntu Bionic): | |
status: | New → Fix Released |
I'm assigning the Bionic fixes to Rik; I'm unsure if plasma-workspace is still affected, but it seems kde-runtime is in fact affected.