Command Injection in RPM via Malicious Gem File

Executive Summary

This vulnerability in the RPM package manager allows command execution via macro expansion in the rpmuncompress -x command when processing crafted .gem filenames. Attackers can supply filenames containing RPM macro syntax like %(...), which triggers shell macro execution during command construction. This enables arbitrary command execution with the privileges of the invoking user or build account.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious `.gem` files with macro syntax like `%(...)` in filenames. Use commands such as `find / -name '*.gem' -type f 2>/dev/null | grep -E '%\(|\$\{'` to locate potential malicious files. Monitor `/tmp` for unexpected files created during `rpmuncompress -x` execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your system with the same privileges as the user running rpmuncompress -x. This could lead to data theft, system damage, or unauthorized access. Exploitation requires only that you or an automated process processes a malicious .gem file.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential exposure of sensitive data, requiring organizations to implement mitigations and monitor affected systems.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid using `rpmuncompress -x` on untrusted `.gem` files. Rename suspicious files to remove macro syntax like `%(...)` or `${}`. Use alternative extractors that do not expand macros in filenames. Monitor for updates from Red Hat and apply patches once available.

Useful 0 Not Useful 0