build: unsafe use of cpio [LWN.net]

Package(s):

build

CVE #(s):

CVE-2010-4226

Created:

March 15, 2011

Updated:

April 18, 2011

Description:

From the openSUSE advisory:

The build script uses cpio to extract untrusted rpm packages for bootstrapping virtual machines. cpio is not safe to use for this task, therefore the build script now uses bsdtar instead

Alerts:

SUSE	SUSE-SR:2011:005	hplip, perl, subversion, t1lib, bind, tomcat5, tomcat6, avahi, gimp, aaa_base, build, libtiff, krb5, nbd, clamav, aaa_base, flash-player, pango, openssl, subversion, postgresql, logwatch, libxml2, quagga, fuse, util-linux	2011-04-01
openSUSE	openSUSE-SU-2011:0174-1	build	2011-03-15

to post comments

cpio not safe? Why not?

Posted Mar 17, 2011 9:42 UTC (Thu) by epa (subscriber, #39769) [Link] (1 responses)

I posted a comment on the linked alert but I should probably have posted it here instead:

Uh, 'cpio is not safe for this task'? What does it do wrong? Does this mean it is unsafe to use cpio to extract archives in general, unless they are from a trusted source?

I'm guessing it might be because cpio uncritically makes setuid programs, device files and so on. (Though running it as root would mitigate most of that, it could still create setuid programs owned by the current user.) Or is it because cpio has path traversal exploits with ../.. stuff in the archive filenames?

Whatever it is, it sounds a bit like the advisory and fix should be against cpio itself. Does someone have more details?

cpio not safe? Why not?

Posted Mar 17, 2011 13:59 UTC (Thu) by ferringb (subscriber, #20752) [Link]

take a look at the linked comment for an explanation.