Hi,

line 496 of syncoid reads

$recvoptions .= " -o $key=$value";

this string is then apparently passed to a shell, which will split $value into words on whitespace, causing the zfs command line to become invalid at best and do something nasty at worst (think e.g. "zfs set foo='; zpool destroy tank'" or "zfs set foo='$(cat /path/to/secret/file)'" -- I haven't determined whether these would "work" but they might).

The following looks like a valid quick fix, but I don't know enough perl to be sure:

$recvoptions .= " -o $key='''$value'''";

Justification for severity 'important': this is serious (potentially security relevant) breakage but it doesn't affect everyone.

András

OK, that quick fix will work for whitespace but still break on apostrophes.

How about using the escapeshellparam sub? https://github.com/jimsalterjrs/sanoid/blob/61000c9da2f8762424ba2de8a49abb1b7ec5154d/syncoid#L2070

Or, better yet, replace that sub with this: https://metacpan.org/dist/String-ShellQuote/source/ShellQuote.pm (why reinvent the wheel?).

András

Hi,

Can you open a bug upstream? I would prefer to go with a fix approved by upstream.

Also I'm not sure I understand under which circumstances the content of
'$value' could be controlled by an 'adversary'? Can you explain shortly what
would be an exploitation scenario you envision?

Thanks,

Michael

On Mon, Oct 02, 2023 at 04:00:57PM -0400, Michael Jeanson wrote:

Hi,

Sure, will do.

It doesn't have to be an adversary; you could also have some free-text comment in a zfs user property that, if passed to a shell unescaped, does something you don't want. My examples were perhaps extreme.

That said, at least two feasible scenarios exist:

1. the admin could be delegating the permission to set properties to users (using zfs allow), who would then potentially be adversaries. If "userprop" is delegated, the user can create their own free-text properties.

2. you could be working with a zfs pool created by an adversary (e.g. as part of a forensic examination).

András

I believe this bug was fixed upstream and is includes in the new upstream version 2.3.0 released just a couple of weeks ago. Would be nice to have the new version in trixie.

https://github.com/jimsalterjrs/sanoid/pull/882
https://github.com/jimsalterjrs/sanoid/releases/tag/v2.3.0

We believe that the bug you reported is fixed in the latest version of
sanoid, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1053358@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Jeanson <mjeanson@debian.org> (supplier of updated sanoid package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 08 Aug 2025 13:21:03 -0400
Source: sanoid
Architecture: source
Version: 2.3.0-1
Distribution: unstable
Urgency: medium
Maintainer: Michael Jeanson <mjeanson@debian.org>
Changed-By: Michael Jeanson <mjeanson@debian.org>
Closes: 1053358
Changes:
 sanoid (2.3.0-1) unstable; urgency=medium
 .
   * [e27b1df] New upstream version 2.3.0 (Closes: #1053358)
   * [7369fe6] Bump standards version to 4.7.2
   * [826df1c] Refresh patches for 2.3.0
   * [bb6433a] Update man pages
   * [ecc05ce] Update lintian-overrides
Checksums-Sha1:
 25273a509bb90d9c088417e0ef3415c6950b7d4c 1834 sanoid_2.3.0-1.dsc
 36212def706ddbe52819a3dd3fcef32841853a6c 86514 sanoid_2.3.0.orig.tar.gz
 0c672079f7d7bd0b7abebc33d3eff73e14291bc7 6156 sanoid_2.3.0-1.debian.tar.xz
 b4b351d4d875eceb83702ca960b259c2c7a8f0da 5823 sanoid_2.3.0-1_source.buildinfo
Checksums-Sha256:
 2b6bc84d00e861cd5cf6b557cd910ec00f5a4b741a2760246a042d70d5a8dd4d 1834 sanoid_2.3.0-1.dsc
 1d8735a271a34ec87ea46313a66f6f20bd38b583886924574d3c1f72ea173620 86514 sanoid_2.3.0.orig.tar.gz
 88c19ee974684da4616b21dd63da82ecb45ebbfbe4c8f445b8f7de4036936e9f 6156 sanoid_2.3.0-1.debian.tar.xz
 698c872d5f8a38f52c590bf2c1372685d9af9a730748b582c4ca8b30d3c0595b 5823 sanoid_2.3.0-1_source.buildinfo
Files:
 e489af4146b76eb25579fc0976c18b4a 1834 admin optional sanoid_2.3.0-1.dsc
 597ab95d9e9bded065a06a423de23abd 86514 admin optional sanoid_2.3.0.orig.tar.gz
 ec76875122eec29c6568b7b4210534ad 6156 admin optional sanoid_2.3.0-1.debian.tar.xz
 b46abfaabde45ee281cbc7e1ca6d0424 5823 admin optional sanoid_2.3.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEmGYkMkK2Qid54gtihlYfRSGA/P4FAmiWMmoUHG1qZWFuc29u
QGRlYmlhbi5vcmcACgkQhlYfRSGA/P4BoQ//ely5OpbYnfQGX78pLIjA9ekt4bGx
i80yv/YXxo5A6wTUqOtlr5vAyn3uAnA4S3v7JqHgwfAuObl/+rsMKDF9Z8atCH5n
JhyDfZBV4PYBfyfr52nJ1B/6pkXY0DSV3weeG7aBVE407YshSuvEUq7BqGLHO9lw
Z/rmo54+Z+bgs385d6sJ0Dn5YeMGvsVt/IxPQx0CEqkW/9lrvUCSuvChlxCX5NEd
2FJI0w+Rhr7vujn+30dtQN/1dM4nefdES9bIuen2uWrq7Et8hLlTGjspSLz1P8gX
0qMgtHAe7dH7Ip9ANuwccO/uYvtwMuGIJ/ro/q5MXqOLiM3P1AKNGg+sLA1W8fUa
eOiKal9bqbfPOrSvcBS+nGnt14Jb+Fz5CEbUC+bsYeVtaWRiIFD8TiZE4lYRZVJ2
QuKOISQxUyeyntrB7Q/aLQlREHQUIdGxn6ZnPDCDoYhR/4eICsHqR5dLK4uB2a9b
VWJ4/GQigPkl7eCCujqqJbBSLUh7SrF2iWEXwxe5HnsP46EhkZMFBsk0NaSQ8nBN
Fg7By9yC28/5YHHaJf/pv+mQ4ZZztTqHnGbG2LoNPRdj79EqH3e67/p61dtMk2A6
eVbH4UxVVbQAnAcQ2FJtlmupjHPEiyUn6duk5/oGqce/r145PKcNW49qhe0gK8Mf
T1VnxHnC60LsqW8=
=VIgn
-----END PGP SIGNATURE-----