Saint DynoRoot, Who Took Orders From the DHCP

Patron of DHCP clients, system scripts written in haste, and networks that trust the first to answer.

Life

In May 2018 Felix Wilhelm of Google's security team found DynoRoot (CVE-2018-1111): the script integrating the DHCP client with NetworkManager on Red Hat, Fedora and their derivatives passed values received from the server to the shell without sanitising them. A malicious DHCP server, or an attacker able to answer first on the network, could thus run commands as root on the client simply by handing it an address.

Prayer

O Saint DynoRoot, who takes for granted every value that arrives from the network, let our scripts quote what they do not trust. Amen.

How to celebrate

Celebrated by installing the May 2018 updates and remembering that even the one handing out addresses is a stranger.

The one who hands out addresses is not always a friend.