Public bug reported:
Hello,
I have detected a reproducible false positive in chkrootkit's binary
scanning routine, that manifests on Ubuntu (at least) since 26.04 - it
did not yet show up for Ubuntu 24.04.
Root Cause:
The chkrootkit shell script utilizes `strings -a` and pipes the output into a
loose regular expression check looking for the literal string "bash" (as one of
the |-separated alternatives) inside various system utilities to detect
trojaned utilities.
The Issue:
Starting with Ubuntu 26.04, many bundled system utilities are built using
Rust/Cargo. Some cargo-dependent crates include comprehensive localization or
international calendar features (specifically supporting the Coptic calendar).
The 9th month of the Coptic calendar is "Bashans" (often stored or compiled
containing the substring "bash").
Because these utilities are statically compiled or bundled under a
multi-call binary structure (similar to busybox), any utility pulling in
these calendar features triggers a false positive in chkrootkit simply
because the binary contains the string "bash" within its Coptic calendar
data layout.
Suggested Fix:
The regular expression parsing the `strings -a` output should be hardened.
Instead of a loose match on "bash", it should enforce strict word boundaries
(e.g., using '\<bash\>' or similar anchoring depending on the exact test block)
or use a more robust signature verification to avoid flagging innocent
localized binaries. The complete regular expression is stored in variable
GENERIC_ROOTKIT_LABEL.
Affected version: while Ubuntu ships version 0.58b, the latest 0.59
still contains the exactly same regular expression.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: chkrootkit 0.58b-6build1
ProcVersionSignature: Ubuntu 7.0.0-29.29-generic 7.0.12
Uname: Linux 7.0.0-29-generic x86_64
NonfreeKernelModules: zfs
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Sat Aug 15 18:16:40 2026
InstallationDate: Installed on 2026-07-31 (15 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
ProcEnviron:
LANG=de_DE.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
SourcePackage: chkrootkit
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: chkrootkit (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2163575
Title:
trojan-check looks for "bash", but that hast to many false positives
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/chkrootkit/+bug/2163575/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
