Repository navigation
Unquoted caller path into system() in wdc, sandisk, and solidigm plugins is root command injection #4092
Description
Activity
- changed the title
[-]Unquoted caller path into system() in wdc and solidigm plugins is root command injection[/-][+]Unquoted caller path into system() in wdc, sandisk, and solidigm plugins is root command injection[/+]on Sep 30, 2026 Still, this is a very bad design and it needs to be replaced, e.g. by using libarchive.
I'll will rip out this code within a week if it is not fixed. I had a bad feeling when I accepted it. This was a mistake. This is a complete anti pattern and not acceptable at all.
Reacted by Utkarsh Singh and Hyuntae Kim@igaw, @brandon-paupore-sndk is looking into fixes for the wdc and sndk plugins.
Reacted by Brandon Paupore, Daniel Wagner and Utkarsh Singh@igaw, @keithbusch, I am on the solidigm telemetry instance of this issue. Are you aware of other instances of this issue in the solidigm plugin?
Sorry for the late response, and thanks for looking into this. I've caught up on the discussion and the changes in #4114 .
Still, this is a very bad design and it needs to be replaced, e.g. by using libarchive.
I'll will rip out this code within a week if it is not fixed. I had a bad feeling when I accepted it. This was a mistake. This is a complete anti pattern and not acceptable at all.
Call sites across the nvme-cli vendor plugins interpolate a caller-supplied path into a shell command string with no quoting and pass it to system(3). nvme-cli runs as root, so any principal that can invoke an affected subcommand with controlled arguments gets arbitrary command execution as root.
Proof of concept (not actually run):
cmd_buf becomes:
which /bin/sh splits into tar --remove-files -czf /tmp/a, then chmod u+s $(command -v bash) as root, then a comment. Result: setuid-root bash.
Don't do this. If you want to run a shell command sequence, then write a script to do it and let nvme-cli just do nvme stuff.