https://bugs.dpdk.org/show_bug.cgi?id=109
Bug ID: 109
Summary: Using the environment variable to get the filepath
Product: DPDK
Version: 17.11
Hardware: All
OS: All
Status: IN_PROGRESS
Severity: minor
Priority: Normal
Component: ethdev
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: 17.11
In some functions like
eal_runtime_config_path,
eal_hugepage_info_path,
rte_pci_get_sysfs_path,
DPDK use the environment variable to get the file path like the code below:
const char *rte_pci_get_sysfs_path(void)
{
const char *path = NULL;
path = getenv("SYSFS_PCI_DEVICES");
if (path == NULL)
return SYSFS_PCI_DEVICES;
return path;
}
There are some risks when the envs are changed to some path like
"../../../etc/passwd" and the attackers have chances to construct file paths
for unauthorized access.
--
You are receiving this mail because:
You are the assignee for the bug.
