CVE-2018-12020: GnuPG "SigSpoof": signature/decryption status spoofed via unescaped filename on --status-fd 2
Scope: audit · README · COMPARISON · docs/RESEARCH
Disclosed June 2018. Fixed in GnuPG 2.2.8 / 1.4.23.
Source
Relevance to doos
Applications that ran GnuPG with --status-fd 2 (merging machine-readable status lines
into stderr) and GnuPG's verbose mode (which echoes the input file's embedded name to
stderr without escaping newlines) could be fed a crafted message whose filename field
injected fake status lines, spoofing a GOODSIG result for an unsigned or badly signed
input. doos calls gpg to verify Alpine's and Ubuntu's release signatures
(verifySignature in src/image.cpp), so getting this invocation right is the one place
a bug in this class would matter: a spoofed GOODSIG here would make doos trust and
extract an unverified image.
What the check does
Reads the exact gpg invocations in src/image.cpp for the two properties that defeat
this bug class: --status-fd must be a dedicated fd (not 2, which would merge it with
stderr), and --verbose must not be passed. Source inspection, not a dynamic exploit
attempt: crafting a message that reproduces GnuPG's own newline-escaping bug would be
testing GnuPG, not doos, and depends on an unpatched GnuPG the audit does not control.
Caveats
A static check: it verifies the invocation in the source tree the check runs against,
not the behavior of whatever gpg binary happens to be installed. It also does not
prove there is no other way to smuggle data into the fd doos does read; it confirms the
one specific, named defeat (--status-fd 2 plus --verbose) is not present.
Run: make test in this directory, or make -C audit test from the repo root.