fix(network-legacy): sanitize DHCP values in dhclient-script.sh#2470
fix(network-legacy): sanitize DHCP values in dhclient-script.sh#2470aafeijoo-suse wants to merge 2 commits into
Conversation
github-actions
Bot
added
modules
|
Unrelated CI failure of TEST-72-NBD in openSUSE: #2381 (comment) |
devkontrol
left a comment
devkontrol
left a comment
There was a problem hiding this comment.
Thank you @aafeijoo-suse
|
What should we do about test 72 failing? |
As @aafeijoo-suse mentioned, this failure is unrelated to this PR. It adds to the cognitive load for PR reviews to require this side-discussions on the CI unrelated to PR - this is why I think it is important to keep the CI green at all times so that side-discussion are not needed or part of a separate PR. If fix is not available, than temporary disable to the test run with another commit. |
devkontrol
added
the
highpriority
| echo ip route add "$gw" dev "$netif" > /tmp/net."$netif".gw | ||
| fi | ||
| case "$gw" in | ||
| *[!0-9.]*) |
There was a problem hiding this comment.
According to the code, gw can contain a space separated list of gateways. This code will spit out a warning.
There was a problem hiding this comment.
Yes, sorry, you're right. PTAL.
aafeijoo-suse
force-pushed
the
cve20266893
branch
2 times, most recently
from
3e015f5 to
af8b860
Compare
A rogue DHCP server can inject shell commands through hostname, domain, gateway, and classless static route values. These values are written to /tmp files that setup_net() later sources as shell. - Sanitize hostname to RFC 952 chars (a-zA-Z0-9.-) - Strip control chars from domain (like search already does) - Validate gateway IPs contain only digits and dots - Single-quote interpolated values in generated shell commands - Validate all parse_option_121 octets are numeric upfront; the existing inline checks only validated mask and the first destination octet, leaving dest octets 2-4 and all four gateway octets unchecked — those flow into shell commands written to the initqueue/setup_net_"$netif".sh hook script via echo Fixes: CVE-2026-6893 Co-developed-by: Claude Opus 4.6 <noreply@anthropic.com>
aafeijoo-suse
force-pushed
the
cve20266893
branch
from
af8b860 to
d9fe05f
Compare
4 participants
A rogue DHCP server can inject shell commands through
hostname,domain,gateway, and classless static route values. These values are written to/tmpfiles thatsetup_net()later sources as shell.a-zA-Z0-9.-)domain(likesearchalready does)parse_option_121octets are numeric upfront; the existing inline checks only validatedmaskand the first destination octet, leaving dest octets 2-4 and all four gateway octets unchecked — those flow into shell commands written to theinitqueue/setup_net_"$netif".shhook script viaechoFixes: CVE-2026-6893
Co-developed-by: Claude Opus 4.6 noreply@anthropic.com
Checklist