Package: python-pyopencl Severity: grave Tags: upstream security Justification: user security hole
Dear Maintainer, PyOpenCL creates a cache of compiled kernels in a predictable location in the temporary directory. Assuming a system-wide /tmp, an attacker can exploit this. This allows for arbitrary code execution on OpenCL devices (which could be a CPU); the cache also contains a Python pickle file, which may allow another route to arbitrary code execution. https://github.com/pyopencl/pyopencl/pull/68 contains an upstream patch to fix the issue by storing the cache in the XDG per-user cache directory instead of the temporary temporary. I happen to be running Ubuntu Trusty on the machine where I first discovered this, but it presumably affects any UNIX system with a shared system temporary directory. -- System Information: Debian Release: jessie/sid APT prefers trusty-updates APT policy: (500, 'trusty-updates'), (500, 'trusty-security'), (500, 'trusty'), (100, 'trusty-backports') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 3.13.0-39-generic (SMP w/8 CPU cores) Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
