Carlos O'Donell
a39208bd7f
CVE-2014-7817: wordexp fails to honour WRDE_NOCMD.
...
The function wordexp() fails to properly handle the WRDE_NOCMD
flag when processing arithmetic inputs in the form of "$((... ``))"
where "..." can be anything valid. The backticks in the arithmetic
epxression are evaluated by in a shell even if WRDE_NOCMD forbade
command substitution. This allows an attacker to attempt to pass
dangerous commands via constructs of the above form, and bypass
the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD
in exec_comm(), the only place that can execute a shell. All other
checks for WRDE_NOCMD are superfluous and removed.
We expand the testsuite and add 3 new regression tests of roughly
the same form but with a couple of nested levels.
On top of the 3 new tests we add fork validation to the WRDE_NOCMD
testing. If any forks are detected during the execution of a wordexp()
call with WRDE_NOCMD, the test is marked as failed. This is slightly
heuristic since vfork might be used in the future, but it provides a
higher level of assurance that no shells were executed as part of
command substitution with WRDE_NOCMD in effect. In addition it doesn't
require libpthread or libdl, instead we use the public implementation
namespace function __register_atfork (already part of the public ABI
for libpthread).
Tested on x86_64 with no regressions.
2014-11-19 14:35:03 -05:00
..
2014-02-21 21:45:26 +00:00
2014-02-21 21:45:26 +00:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2013-05-16 11:32:54 -05:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-06-20 14:03:40 +02:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-09-11 16:02:17 -07:00
2014-09-11 16:02:17 -07:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-09-16 22:18:20 +05:30
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-02-10 15:07:12 +01:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-02-10 15:07:12 +01:00
2014-02-21 21:45:26 +00:00
2014-01-01 22:00:23 +10:00
2014-06-07 19:58:36 +00:00
2014-01-01 22:00:23 +10:00
2014-06-19 19:00:03 +02:00
2014-11-01 12:26:09 +00:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-09-11 16:02:17 -07:00
2014-08-01 14:24:41 +05:30
2014-11-04 15:32:07 +01:00
2014-01-01 22:00:23 +10:00
2014-02-12 23:41:01 +00:00
2014-09-11 16:02:17 -07:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-03-07 20:54:03 +00:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-06-26 13:21:58 -07:00
2014-06-11 23:13:42 +02:00
2014-01-01 22:00:23 +10:00
2014-06-11 23:13:42 +02:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-05-23 20:37:40 +00:00
2013-06-08 00:22:23 +00:00
2014-01-01 22:00:23 +10:00
2013-06-06 02:15:33 +02:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2013-01-10 14:14:55 -08:00
2014-01-01 22:00:23 +10:00
2014-06-18 14:20:02 +02:00
2014-11-05 15:24:08 +05:30
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-06-06 22:19:27 +00:00
2014-11-05 15:24:08 +05:30
2014-11-05 15:24:08 +05:30
2014-11-05 15:24:08 +05:30
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-11-12 22:33:41 +00:00
2014-11-12 22:33:41 +00:00
2014-11-12 22:33:41 +00:00
2014-02-14 13:45:14 +00:00
2014-01-01 22:00:23 +10:00
2013-01-10 14:14:55 -08:00
2014-06-11 23:13:42 +02:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-02-21 21:45:26 +00:00
2013-05-06 15:10:09 -07:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-01-01 22:00:23 +10:00
2014-11-07 01:27:16 +00:00
2014-11-19 14:35:03 -05:00
2014-06-06 22:19:27 +00:00
2014-11-19 14:35:03 -05:00
2014-01-01 22:00:23 +10:00