summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core/glibc/glibc/CVE-2014-7817-wordexp-fails-to-honour-WRDE_NOCMD.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-core/glibc/glibc/CVE-2014-7817-wordexp-fails-to-honour-WRDE_NOCMD.patch')
-rw-r--r--meta/recipes-core/glibc/glibc/CVE-2014-7817-wordexp-fails-to-honour-WRDE_NOCMD.patch215
1 files changed, 215 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/CVE-2014-7817-wordexp-fails-to-honour-WRDE_NOCMD.patch b/meta/recipes-core/glibc/glibc/CVE-2014-7817-wordexp-fails-to-honour-WRDE_NOCMD.patch
new file mode 100644
index 0000000000..9bfea10623
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/CVE-2014-7817-wordexp-fails-to-honour-WRDE_NOCMD.patch
@@ -0,0 +1,215 @@
1From a39208bd7fb76c1b01c127b4c61f9bfd915bfe7c Mon Sep 17 00:00:00 2001
2From: Carlos O'Donell <carlos@redhat.com>
3Date: Wed, 19 Nov 2014 11:44:12 -0500
4Subject: [PATCH] CVE-2014-7817: wordexp fails to honour WRDE_NOCMD.
5
6The function wordexp() fails to properly handle the WRDE_NOCMD
7flag when processing arithmetic inputs in the form of "$((... ``))"
8where "..." can be anything valid. The backticks in the arithmetic
9epxression are evaluated by in a shell even if WRDE_NOCMD forbade
10command substitution. This allows an attacker to attempt to pass
11dangerous commands via constructs of the above form, and bypass
12the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD
13in exec_comm(), the only place that can execute a shell. All other
14checks for WRDE_NOCMD are superfluous and removed.
15
16We expand the testsuite and add 3 new regression tests of roughly
17the same form but with a couple of nested levels.
18
19On top of the 3 new tests we add fork validation to the WRDE_NOCMD
20testing. If any forks are detected during the execution of a wordexp()
21call with WRDE_NOCMD, the test is marked as failed. This is slightly
22heuristic since vfork might be used in the future, but it provides a
23higher level of assurance that no shells were executed as part of
24command substitution with WRDE_NOCMD in effect. In addition it doesn't
25require libpthread or libdl, instead we use the public implementation
26namespace function __register_atfork (already part of the public ABI
27for libpthread).
28
29Tested on x86_64 with no regressions.
30---
31 ChangeLog | 22 ++++++++++++++++++++++
32 NEWS | 8 +++++++-
33 posix/wordexp-test.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
34 posix/wordexp.c | 16 ++++------------
35 4 files changed, 77 insertions(+), 13 deletions(-)
36
37Index: git/ChangeLog
38===================================================================
39--- git.orig/ChangeLog
40+++ git/ChangeLog
41@@ -1,3 +1,24 @@
42+2014-11-19 Carlos O'Donell <carlos@redhat.com>
43+ Florian Weimer <fweimer@redhat.com>
44+ Joseph Myers <joseph@codesourcery.com>
45+ Adam Conrad <adconrad@0c3.net>
46+ Andreas Schwab <schwab@suse.de>
47+ Brooks <bmoses@google.com>
48+
49+ [BZ #17625]
50+ * wordexp-test.c (__dso_handle): Add prototype.
51+ (__register_atfork): Likewise.
52+ (__app_register_atfork): New function.
53+ (registered_forks): New global.
54+ (register_fork): New function.
55+ (test_case): Add 3 new tests for WRDE_CMDSUB.
56+ (main): Call __app_register_atfork.
57+ (testit): If WRDE_NOCMD set registered_forks to zero, run test, and if
58+ fork count is non-zero fail the test.
59+ * posix/wordexp.c (exec_comm): Return WRDE_CMDSUB if WRDE_NOCMD flag
60+ is set.
61+ (parse_dollars): Remove check for WRDE_NOCMD.
62+
63 2014-09-07 Allan McRae <allan@archlinux.org
64
65 * version.h (RELEASE): Set to "stable".
66Index: git/NEWS
67===================================================================
68--- git.orig/NEWS
69+++ git/NEWS
70@@ -23,7 +23,13 @@ Version 2.20
71 16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022, 17031,
72 17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078, 17079,
73 17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150, 17153,
74- 17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325, 17354.
75+ 17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325, 17354, 17625.
76+
77+* CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag
78+ under certain input conditions resulting in the execution of a shell for
79+ command substitution when the applicaiton did not request it. The
80+ implementation now checks WRDE_NOCMD immediately before executing the
81+ shell and returns the error WRDE_CMDSUB as expected.
82
83 * Reverted change of ABI data structures for s390 and s390x:
84 On s390 and s390x the size of struct ucontext and jmp_buf was increased in
85Index: git/posix/wordexp-test.c
86===================================================================
87--- git.orig/posix/wordexp-test.c
88+++ git/posix/wordexp-test.c
89@@ -27,6 +27,25 @@
90
91 #define IFS " \n\t"
92
93+extern void *__dso_handle __attribute__ ((__weak__, __visibility__ ("hidden")));
94+extern int __register_atfork (void (*) (void), void (*) (void), void (*) (void), void *);
95+
96+static int __app_register_atfork (void (*prepare) (void), void (*parent) (void), void (*child) (void))
97+{
98+ return __register_atfork (prepare, parent, child,
99+ &__dso_handle == NULL ? NULL : __dso_handle);
100+}
101+
102+/* Number of forks seen. */
103+static int registered_forks;
104+
105+/* For each fork increment the fork count. */
106+static void
107+register_fork (void)
108+{
109+ registered_forks++;
110+}
111+
112 struct test_case_struct
113 {
114 int retval;
115@@ -206,6 +225,12 @@ struct test_case_struct
116 { WRDE_SYNTAX, NULL, "$((2+))", 0, 0, { NULL, }, IFS },
117 { WRDE_SYNTAX, NULL, "`", 0, 0, { NULL, }, IFS },
118 { WRDE_SYNTAX, NULL, "$((010+4+))", 0, 0, { NULL }, IFS },
119+ /* Test for CVE-2014-7817. We test 3 combinations of command
120+ substitution inside an arithmetic expression to make sure that
121+ no commands are executed and error is returned. */
122+ { WRDE_CMDSUB, NULL, "$((`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
123+ { WRDE_CMDSUB, NULL, "$((1+`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
124+ { WRDE_CMDSUB, NULL, "$((1+$((`echo 1`))))", WRDE_NOCMD, 0, { NULL, }, IFS },
125
126 { -1, NULL, NULL, 0, 0, { NULL, }, IFS },
127 };
128@@ -258,6 +283,15 @@ main (int argc, char *argv[])
129 return -1;
130 }
131
132+ /* If we are not allowed to do command substitution, we install
133+ fork handlers to verify that no forks happened. No forks should
134+ happen at all if command substitution is disabled. */
135+ if (__app_register_atfork (register_fork, NULL, NULL) != 0)
136+ {
137+ printf ("Failed to register fork handler.\n");
138+ return -1;
139+ }
140+
141 for (test = 0; test_case[test].retval != -1; test++)
142 if (testit (&test_case[test]))
143 ++fail;
144@@ -367,6 +401,9 @@ testit (struct test_case_struct *tc)
145
146 printf ("Test %d (%s): ", ++tests, tc->words);
147
148+ if (tc->flags & WRDE_NOCMD)
149+ registered_forks = 0;
150+
151 if (tc->flags & WRDE_APPEND)
152 {
153 /* initial wordexp() call, to be appended to */
154@@ -378,6 +415,13 @@ testit (struct test_case_struct *tc)
155 }
156 retval = wordexp (tc->words, &we, tc->flags);
157
158+ if ((tc->flags & WRDE_NOCMD)
159+ && (registered_forks > 0))
160+ {
161+ printf ("FAILED fork called for WRDE_NOCMD\n");
162+ return 1;
163+ }
164+
165 if (tc->flags & WRDE_DOOFFS)
166 start_offs = sav_we.we_offs;
167
168Index: git/posix/wordexp.c
169===================================================================
170--- git.orig/posix/wordexp.c
171+++ git/posix/wordexp.c
172@@ -893,6 +893,10 @@ exec_comm (char *comm, char **word, size
173 pid_t pid;
174 int noexec = 0;
175
176+ /* Do nothing if command substitution should not succeed. */
177+ if (flags & WRDE_NOCMD)
178+ return WRDE_CMDSUB;
179+
180 /* Don't fork() unless necessary */
181 if (!comm || !*comm)
182 return 0;
183@@ -2082,9 +2086,6 @@ parse_dollars (char **word, size_t *word
184 }
185 }
186
187- if (flags & WRDE_NOCMD)
188- return WRDE_CMDSUB;
189-
190 (*offset) += 2;
191 return parse_comm (word, word_length, max_length, words, offset, flags,
192 quoted? NULL : pwordexp, ifs, ifs_white);
193@@ -2196,9 +2197,6 @@ parse_dquote (char **word, size_t *word_
194 break;
195
196 case '`':
197- if (flags & WRDE_NOCMD)
198- return WRDE_CMDSUB;
199-
200 ++(*offset);
201 error = parse_backtick (word, word_length, max_length, words,
202 offset, flags, NULL, NULL, NULL);
203@@ -2357,12 +2355,6 @@ wordexp (const char *words, wordexp_t *p
204 break;
205
206 case '`':
207- if (flags & WRDE_NOCMD)
208- {
209- error = WRDE_CMDSUB;
210- goto do_error;
211- }
212-
213 ++words_offset;
214 error = parse_backtick (&word, &word_length, &max_length, words,
215 &words_offset, flags, pwordexp, ifs,