[U-Boot] Kernel bootparam injection

[Christian Litjes]

Dear Denx,

I've been working on an embedded system which starts over TFTP with an NFS
rootfs.

During the development I noticed that it's possible to inject bootparams in
to the dhcp messages.

If a system boots from NFS and I provide the following path to the nfs
share the extra bootparams will be executed aswell.

option root-path "/media/share/nfs/,tcp ro"

The ro parameter is put in to the kernel parameter as well and executed.

I'm using this hack currently on our own system into our advantage to
override the rw with ro in the kernel command line without the need of
recompiling uboot.
I'm going to plug this hole because it's a security risk for our product.
I've looked in the current uboot version and this is still a possibility.

My suggestion is to verify the options passed trough, these are separated
by "," and ignore anything with a space inside the rootpath.

If you agree this is an issue and have a suggestion for a solution. I will
supply the patch we are currently using for our own product.

Kind regards,
Christian Litjes