installdbgsymbols examples use unsafe
The scripts under ./src/doc/examples/installdbgsymbols_*
use a predictable FIFO file in /tmp in an unsafe way:
run_in_terminal()
{
local fifo=/tmp/drkonqi-fifo-$$
mkfifo $fifo
# start terminal
konsole -e sh -c "echo \$\$ > $fifo; $1; exit_status=\$?; sleep 1; rm $fifo; echo \$exit_status > $fifo" &
# wait for it to finish
local pid=`cat $fifo`
while [ "$?" = "0" ]; do
sleep 1
kill -0 $pid 2>/dev/null
done
<snip...>
The shell's errexit
option is not set, i.e. if mkfifo
fails, then execution still continues. This means another user in the system can precreate the FIFO and feed crafted information to it. In the context of this function this poses a possible local DoS, because the attacker can specify an arbitrary PID that will then be killed by the script.
To fix this, I suggest to execute set -e
, this will abort execution should mkfifo
fail. Ideally using $XDG_RUNTIME_DIR
instead of /tmp would be even better.