Package: release.debian.org
Severity: normal
Package: release.debian.org
Severity: normal
Tags: trixie
User: [email protected]
Usertags: pu
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:gpsd
Dear release team,
I would like to fix two command/code injection vulnerabilities in the
gpsprof diagnostic client in trixie.
[ Reason ]
Both issues were fixed upstream after the 3.27.5 release and are still
present in trixie's 3.25-5+deb13u1.
CVE-2026-58459 (#1141962): the GPS device "subtype" value, which comes
from a DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
the generated gnuplot program via a "set title" statement with only
double quote characters escaped. Backtick payloads therefore survive
and gnuplot executes them as shell commands when the plot is rendered.
CVE-2026-60122: SKY.satellites[].used is written unsanitised into a
gnuplot heredoc data block. A "used" value containing the string EOD
terminates the heredoc early, after which the attacker can append
gnuplot system() calls, giving OS command execution in polar mode.
The security team marked CVE-2026-58459 <no-dsa> (Minor issue) for
trixie, hence this proposed-update rather than a DSA. CVE-2026-60122
has not been triaged for trixie yet, but it is the same class of bug in
the same client, so I would rather fix both in a single upload.
[ Impact ]
A user who runs gpsprof against an untrusted GPS device or an untrusted
gpsd log, and then renders the resulting plot with gnuplot, can be made
to execute arbitrary shell commands as their own user.
If the update is not accepted, trixie keeps shipping a gpsprof that
turns device-controlled data into shell commands.
[ Tests ]
The package was built in a trixie chroot; gpsd's regression suite runs as
part of the build and passes (test/daemon/*.log, including the NMEA fuzzy
cases). All twelve patches apply with no fuzz and no offsets.
The upstream fixes were verified against upstream git: applying them to
the 3.27.5 tree reproduces upstream commit 5a9c44a4's clients/gpsprof.py.in
byte for byte. For trixie the patches are backports onto 3.25:
- CVE-2026-58459.patch applies with line offsets only; the surrounding
code is unchanged between 3.25 and 3.27.5.
- CVE-2026-60122.patch needed one hunk rebased, because 3.25 spells the
polarplot guard as a single line,
if (('polarused' == self.name) and (sat['used'] is False)):
where 3.27.5 splits it over two lines. No functional difference; the
deviation is documented in the patch header.
The patched clients/gpsprof.py.in passes py_compile, and the resulting
file contains the same escaping and boolean-forcing as fixed upstream.
[ Risks ]
Low. The changes are confined to clients/gpsprof.py.in, a standalone
diagnostic client shipped in gpsd-clients. Neither the gpsd daemon nor
libgps is touched, so there is no risk to the parts of the package that
run unattended or are linked by other software.
The fixes are escaping and type-forcing only; they add no new code paths.
The one behavioural change a user could notice is that a plot title or
terminal name containing " or ` now renders those characters escaped
rather than being interpreted by gnuplot, which is the point of the fix.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
Two new patches, added to debian/patches/series, plus the changelog
entry. The debdiff is purely additive: no existing file content is
modified other than appending to series.
changelog | 21 ++++++++++++
patches/CVE-2026-58459.patch | 73 +++++++++++++++++++++++++++++++++++++++++++
patches/CVE-2026-60122.patch | 50 +++++++++++++++++++++++++++++
patches/series | 2 +
4 files changed, 146 insertions(+)
[ Other info ]
The same two fixes are in unstable in gpsd 3.27.5-1.
Upstream references:
CVE-2026-58459: https://gitlab.com/gpsd/gpsd/-/work_items/404
commits 5581ba19, 1a6bb7bc, 4c06658e
CVE-2026-60122: https://gitlab.com/gpsd/gpsd/-/work_items/406
commit 5a9c44a4
debdiff attached.
diff -Nru gpsd-3.25/debian/changelog gpsd-3.25/debian/changelog
--- gpsd-3.25/debian/changelog 2026-01-17 16:51:45.000000000 +0000
+++ gpsd-3.25/debian/changelog 2026-07-25 21:40:31.000000000 +0000
@@ -1,3 +1,24 @@
+gpsd (3.25-5+deb13u2) trixie; urgency=medium
+
+ * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability
+ exists in the gpsprof client. The subtype field, sourced from a
+ DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
+ the generated gnuplot program via a set title statement with only
+ double quote characters escaped. An attacker who controls the GPS
+ device subtype can embed backtick payloads and execute arbitrary
+ shell commands as the user running gnuplot when the generated plot
+ is rendered.
+ * Fix CVE-2026-60122. A code injection vulnerability exists in the
+ gpsprof client. The SKY.satellites[].used field is inserted
+ unsanitized into a gnuplot heredoc data block. An attacker who
+ controls the GPS input data can supply a used value containing the
+ string EOD to terminate the heredoc early and append gnuplot
+ system() calls, achieving OS command execution as the user running
+ gpsprof when the generated plot script is processed by gnuplot in
+ polar mode.
+
+ -- Boian Bonev <[email protected]> Sat, 25 Jul 2026 21:40:31 +0000
+
gpsd (3.25-5+deb13u1) trixie; urgency=medium
* Non-Maintainer Upload by LTS team
diff -Nru gpsd-3.25/debian/patches/CVE-2026-58459.patch
gpsd-3.25/debian/patches/CVE-2026-58459.patch
--- gpsd-3.25/debian/patches/CVE-2026-58459.patch 1970-01-01
00:00:00.000000000 +0000
+++ gpsd-3.25/debian/patches/CVE-2026-58459.patch 2026-07-25
21:40:31.000000000 +0000
@@ -0,0 +1,73 @@
+From: Gary E. Miller <[email protected]>
+Subject: gpsprof: quote double quotes and back ticks in title and terminal
+
+gpsd through release-3.27.5 contains a command injection vulnerability in
+gpsprof that allows attackers who control the GPS device subtype value to
+execute arbitrary shell commands by embedding backtick payloads in the
+gnuplot plot title without proper escaping. The subtype field, sourced
+from a DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
+the generated gnuplot program via a "set title" statement with only double
+quote characters escaped, enabling arbitrary shell command execution as the
+user running gnuplot when the victim renders the generated plot through the
+gpsprof and gnuplot workflow.
+
+Escape ", ` and newline in the plot description, in the title and in the
+terminal name before writing them into the gnuplot program.
+
+This is the cumulative upstream fix, squashed from commits 5581ba19,
+1a6bb7bc and 4c06658e; the middle commit had a typo that made the back tick
+substitution a no-op, corrected by the last one.
+
+Backported to 3.25: line offsets only, the surrounding code is unchanged
+between 3.25 and 3.27.5.
+
+Origin: upstream,
https://gitlab.com/gpsd/gpsd/-/commit/5581ba196d826a984fbfaf792b7d58535f9911ce
+Origin: upstream,
https://gitlab.com/gpsd/gpsd/-/commit/1a6bb7bcbdf58aa940132e630870af061dc88537
+Origin: upstream,
https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56
+Applied-Upstream: 4c06658e988f4ced1a7a574ce082a22ef625df56
+Bug: https://gitlab.com/gpsd/gpsd/-/work_items/404
+Bug-Debian: https://bugs.debian.org/1141962
+Last-Update: 2026-07-25
+
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -233,6 +233,11 @@ class plotter(object):
+ if 'subtype' in self.device:
+ desc += "\\n%s" % self.device['subtype']
+
++ # escape ", `, and \n, for gnuplot, to not break strings
++ desc = desc.replace('"', '\\042')
++ desc = desc.replace("\x60", '\\140')
++ desc = desc.replace('\n', '')
++
+ return desc
+
+ def collect(self, verb, log_fp=None):
+@@ -1292,16 +1297,23 @@ if __name__ == '__main__':
+ # Ship the plot to standard output
+ if not options.title:
+ options.title = plot.whatami()
+- # escape " for gnuplot
+- options.title = options.title.replace('"', '\\"')
+ if options.subtitle:
+ options.title += '\\n' + options.subtitle
++ # escape ", and`, for gnuplot, to not break strings
++ options.title = options.title.replace('"', '\\042')
++ options.title = options.title.replace("\x60", '\\140')
+ term_opts = ""
+ truecolor_terms = ['png', 'sixelgd', 'wxt']
+ if options.terminal in truecolor_terms:
+ term_opts = 'truecolor'
+- sys.stdout.write("set terminal %s size 800,950 %s\n"
+- "set termoption enhanced\n"
++
++ # escape ", `, and \n, for gnuplot, to not break strings
++ options.terminal = options.terminal.replace('"', '\\042')
++ options.terminal = options.terminal.replace("\x60", '\\140')
++ options.terminal = options.terminal.replace('\n', '')
++
++ sys.stdout.write('set terminal "%s" size 800,950 %s\n'
++ 'set termoption enhanced\n'
+ % (options.terminal, term_opts))
+ # double quotes on title so \n is parsed by gnuplot
+ sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title)
diff -Nru gpsd-3.25/debian/patches/CVE-2026-60122.patch
gpsd-3.25/debian/patches/CVE-2026-60122.patch
--- gpsd-3.25/debian/patches/CVE-2026-60122.patch 1970-01-01
00:00:00.000000000 +0000
+++ gpsd-3.25/debian/patches/CVE-2026-60122.patch 2026-07-25
21:40:31.000000000 +0000
@@ -0,0 +1,50 @@
+From: Gary E. Miller <[email protected]>
+Subject: gpsprof: ensure sats.used is boolean
+
+gpsd through release-3.27.5 contains a code injection vulnerability in the
+gpsprof utility that allows an attacker who controls GPS input data to
+execute arbitrary OS commands by injecting malicious content into the
+SKY.satellites[].used field, which is inserted unsanitized into a gnuplot
+heredoc data block. An attacker can supply a used value containing the
+string EOD to terminate the heredoc early and append gnuplot system()
+calls, achieving OS command execution as the user running gpsprof when the
+generated plot script is processed by gnuplot in polar mode.
+
+Force sat.used to a real boolean so nothing attacker controlled can reach
+the generated gnuplot program.
+
+Backported to 3.25: the polarplot hunk needed rebasing, as 3.25 spells the
+guard as a single line, "if (('polarused' == self.name) and (sat['used'] is
+False)):", where 3.27.5 splits it over two lines. No functional difference.
+
+Origin: backport,
https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93
+Applied-Upstream: 5a9c44a42136b9bb98d460a8a716e9fd344a8d93
+Bug: https://gitlab.com/gpsd/gpsd/-/work_items/406
+Last-Update: 2026-07-25
+
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -367,8 +367,11 @@ class spaceplot(plotter):
+ # get sat used count
+ sats_used = 0
+ for sat in self.session.satellites:
+- if sat.used:
++ if sat.used is True:
+ sats_used += 1
++ else:
++ # ensure it is boolean.
++ sat.used = False
+
+ if 'altHAE' not in self.session.data:
+ self.session.data['altHAE'] = gps.NaN
+@@ -814,6 +817,10 @@ class polarplot(plotter):
+ used += 1
+ if 'polarunused' == self.name:
+ continue
++ else:
++ # ensure it is boolean.
++ sat['used'] = False;
++
+ if (('polarused' == self.name) and (sat['used'] is False)):
+ continue
+ self.fixes.append((sat['PRN'], sat['ss'], sat['az'],
diff -Nru gpsd-3.25/debian/patches/series gpsd-3.25/debian/patches/series
--- gpsd-3.25/debian/patches/series 2026-01-17 16:51:45.000000000 +0000
+++ gpsd-3.25/debian/patches/series 2026-07-25 21:40:31.000000000 +0000
@@ -7,3 +7,5 @@
build-on-hurd.patch
CVE-2025-67268.patch
CVE-2025-67269.patch
+CVE-2026-58459.patch
+CVE-2026-60122.patch
