Re: cpio RCE Exploit Caused by Integer Overflow

[Juerg Haefliger]

Sergey,

While the hang is gone I'm still seeing a regression when building an Ubuntu
kernel:

find . -path './debian' -prune -o -path './debian.raspi' -prune \
  -o -path './include/*' -prune \
  -o -path './scripts/*' -prune -o -type f \
  \( -name 'Makefile*' -o -name 'Kconfig*' -o -name 'Kbuild*' -o \
     -name '*.sh' -o -name '*.pl' -o -name '*.lds' \) \
  -print | cpio -pd --preserve-modification-time 
/<<PKGBUILDDIR>>/debian/linux-raspi-headers-5.13.0-1005/usr/src/linux-raspi-headers-5.13.0-1005
cpio: turn.sh: Cannot stat: No such file or directory
cpio: ure/bin/kvm-test-1-run-batch.sh: Cannot stat: No such file or directory
cpio: /sch_ets_core.sh: Cannot stat: No such file or directory
cpio: efile: Cannot stat: No such file or directory
cpio: ice_scale.sh: Cannot stat: No such file or directory
cpio: bug: Cannot stat: No such file or directory
cpio: ig: Cannot stat: No such file or directory
cpio: er/Makefile: Cannot stat: No such file or directory
cpio: 
/<<PKGBUILDDIR>>/debian/linux-raspi-headers-5.13.0-1005/usr/src/linux-raspi-headers-5.13.0-1005/./Makefile
 not created: newer or same age version exists

PKGBUILDDIR 'build/linux-raspi-Xjl5Si/linux-raspi-5.13.0'.

...Juerg

pgp6n8rTgmTaP.pgp
Description: OpenPGP digital signature