This article is more than 1 year old

Until last week, you could pwn KDE Linux desktop with a USB stick

Tweak VFAT volume to execute arbitrary code

A recently resolved flaw in the KDE Linux desktop environment meant that files held on a USB stick could be executed as soon as they were plugged into a vulnerable device.

The security howler created a means to execute arbitrary code on KDE by simply naming a pendrive VFAT volume $() or similar, as explained in this advisory (extract below) put out late last week:

When a vfat thumbdrive which contains `` or $() in its volume label is plugged and mounted [through] the device notifier, it's interpreted as a shell command, leaving a possibility of arbitrary commands execution. an example of offending volume label is "$(touch b)" which will create a file called b in the home folder.

Screenshot of Q4OS

Fresh bit o' Linux to spruce up that ancient Windows Vista box? Why not, we say...


The CVE-2018-6791 vulnerability – unsurprisingly designated as high risk – was fixed on Thursday with an update to the Plasma Desktop.

Plasma versions before 5.12.0 need updating. If this isn't immediately possible, then a workaround can be applied to avoid potential pwnage, which involves mounting removable devices with Dolphin instead of the device notifier.

The project has just released its second generation Ultrabook, the KDE Slimbook II, based on its Neon Linux flavour, with a Spanish hardware manufacturer partner. ®

More about

More about

More about


Send us news

Other stories you might like