kmod-project / kmod

kmod - Linux kernel module handling
GNU Lesser General Public License v2.1
50 stars 39 forks source link

Fix potential security vulnerability #260

Open GraysonNocera opened 6 days ago

GraysonNocera commented 6 days ago

Hello, I was running some CodeQL queries on this project when I came across a potential unbounded write that could cause buffer overflow. I have implemented the fix in this PR.

Screenshot 2024-11-23 at 3 09 23 PM

evelikov commented 5 days ago

Please squash the commit and add appropriate commit message. If possible avoid adding pictures in PRs but instead describe in your own words the issue at hand and how the commit addresses it.

Personally I am not worried about any security implications, since to trigger a specially crafted input file which is available in root-only location.

GraysonNocera commented 4 days ago

Hello, thank you for the replies @stoeckmann and @evelikov. I fully understand and agree with the concerns about the new sprintf. I have squashed the commits and implemented the one-line fix.

evelikov commented 3 days ago

@GraysonNocera cannot see a commit message which explains the problem and/or solution. Check through git log for examples.