From 8b0f20002536867bd73ff4552408a72597190cbe Mon Sep 17 00:00:00 2001 From: Ken Sharp Date: Thu, 24 Aug 2023 15:24:35 +0100 Subject: [PATCH] IJS device - try and secure the IJS server startup Bug #707051 ""ijs" device can execute arbitrary commands" The problem is that the 'IJS' device needs to start the IJS server, and that is indeed an arbitrary command line. There is (apparently) no way to validate it. Indeed, this is covered quite clearly in the comments at the start of the source: * WARNING: The ijs server can be selected on the gs command line * which is a security risk, since any program can be run. Previously this used the awful LockSafetyParams hackery, which we abandoned some time ago because it simply couldn't be made secure (it was implemented in PostScript and was therefore vulnerable to PostScript programs). This commit prevents PostScript programs switching to the IJS device after SAFER has been activated, and prevents changes to the IjsServer parameter after SAFER has been activated. SAFER is activated, unless explicitly disabled, before any user PostScript is executed which means that the device and the server invocation can only be configured on the command line. This does at least provide minimal security against malicious PostScript programs. Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=e59216049cac290fb437a04c4f41ea46826cfba5] CVE: CVE-2023-43115 Signed-off-by: Vijay Anusuri --- devices/gdevijs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/devices/gdevijs.c b/devices/gdevijs.c index 3d337c5..e50d69f 100644 --- a/devices/gdevijs.c +++ b/devices/gdevijs.c @@ -934,6 +934,9 @@ gsijs_finish_copydevice(gx_device *dev, const gx_device *from_dev) static const char rgb[] = "DeviceRGB"; gx_device_ijs *ijsdev = (gx_device_ijs *)dev; + if (ijsdev->memory->gs_lib_ctx->core->path_control_active) + return_error(gs_error_invalidaccess); + code = gx_default_finish_copydevice(dev, from_dev); if(code < 0) return code; @@ -1363,7 +1366,7 @@ gsijs_put_params(gx_device *dev, gs_param_list *plist) if (code >= 0) code = gsijs_read_string(plist, "IjsServer", ijsdev->IjsServer, sizeof(ijsdev->IjsServer), - dev->LockSafetyParams, is_open); + ijsdev->memory->gs_lib_ctx->core->path_control_active, is_open); if (code >= 0) code = gsijs_read_string_malloc(plist, "DeviceManufacturer", -- 2.25.1