QR code generation leaks sensitive data via /proc in qrencode

Executive Summary

This vulnerability involves two invocations of the qrencode tool that display a QR code for scanning. These invocations expose sensitive private data, specifically a PIN or key, through the /proc filesystem. The /proc filesystem is accessible to low-privileged users on the system, allowing them to view this confidential information.

Useful 0 Not Useful 0

Detection Guidance

Check for processes running qrencode with sensitive data exposure. Inspect /proc for qrencode invocations leaking $pin or $key. Use commands like ps aux | grep qrencode or ls -l /proc/*/fd/ to identify suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could access the /proc filesystem and retrieve exposed private data such as a PIN or key. This could lead to unauthorized access to sensitive systems or data, depending on what the PIN or key is used for. The impact is primarily on confidentiality as the attacker gains access to private information.

Useful 0 Not Useful 0

Mitigation Strategies

Update affected SUSE/openSUSE systems to the latest sdbootutil package. Remove or restrict access to /proc entries for qrencode processes. Monitor for unauthorized access to sensitive data.

Useful 0 Not Useful 0