Bug#1028479: bpfcc-tools: insecure use of /tmp

2023-01-23 Thread Ritesh Raj Sarraf
Control: tag -1 pending Hello Jakub, Thank you for your bug report. I have prepared a fix and tested it locally. Will be uploading it soon today. rrs@chutzpah:/var/tmp$ cat /tmp/kheaders-6.1.0-2-amd64/include/linux/kconfig.h #error this header is malicious 17:19 ♒♒♒☹

Bug#1028479: bpfcc-tools: insecure use of /tmp

2023-01-11 Thread Jakub Wilk
Package: bpfcc-tools Version: 0.25.0+ds-1 Tags: security If kernel headers are not installed in the usual place, the BPF tools try to look them up in /tmp/kheaders-$(uname -r)/, even when this directory is owned by another user. This can be exploited for denial of service, or likely