Monitoring plugin check_smart 6.9.1 released: Security fix in pseudo-device path

Written by - 0 comments

Published on April 8th 2021 - Listed in Monitoring Hardware Security


An internal security audit at SUSE has come across a potential security issue in the check_smart script, a monitoring plugin to check physical hard-, solid sate and NVMe drives.

Since version 6.1, the -d parameter also supports a so-called pseudo device, located at /dev/bus/XX and representing drive(s) behind a raid controller in certain systems. To detect this path in the input, the regular expression was not good enough. This lead to the possibility, that someone could use whatever path as input, as long as it contained the string "/dev/bus" and a number:

$ sudo ./check_smart.pl -d /tmp/dev/bus/99 -i ata
[sudo] password for ck:      
UNKNOWN: Drive  S/N :  No health status line found|

To execute check_smart, sudo privileges are (unfortunately) required. The monitoring plugin launches smartctl in the background. Even though smartctl does not execute the path in any way but rather tries to read from it, it cannot be excluded that some method exists to execute the path.

The regex was fixed in the newest release 6.9.1 and an attempt to use a path outside of /dev/ results in the following error now:

$ sudo ./check_smart.pl -d /tmp/dev/bus/99 -i ata
[sudo] password for ck: 
Could not find any valid block/character special device for device /tmp/dev/bus/99  !

As 6.9.1 is a security release, an update is strongly recommended.

Thanks to Wolfgang Frisch from SUSE for the great collaboration and information exchange.


Add a comment

Show form to leave a comment

Comments (newest first)

No comments yet.