glibc/CVE-2014-7817-wordexp-fails-to-honour-WRDE_NOCMD.patch

   1 From b9b6e3f01655942891bf4c66a2c5e8246cdad7e1 Mon Sep 17 00:00:00 2001
   2 From: Carlos O'Donell <carlos@redhat.com>
   3 Date: Wed, 19 Nov 2014 11:44:12 -0500
   4 Subject: [PATCH 1/2] CVE-2014-7817: wordexp fails to honour WRDE_NOCMD.
   5
   6 The function wordexp() fails to properly handle the WRDE_NOCMD
   7 flag when processing arithmetic inputs in the form of "$((... ``))"
   8 where "..." can be anything valid. The backticks in the arithmetic
   9 epxression are evaluated by in a shell even if WRDE_NOCMD forbade
  10 command substitution. This allows an attacker to attempt to pass
  11 dangerous commands via constructs of the above form, and bypass
  12 the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD
  13 in exec_comm(), the only place that can execute a shell. All other
  14 checks for WRDE_NOCMD are superfluous and removed.
  15
  16 We expand the testsuite and add 3 new regression tests of roughly
  17 the same form but with a couple of nested levels.
  18
  19 On top of the 3 new tests we add fork validation to the WRDE_NOCMD
  20 testing. If any forks are detected during the execution of a wordexp()
  21 call with WRDE_NOCMD, the test is marked as failed. This is slightly
  22 heuristic since vfork might be used in the future, but it provides a
  23 higher level of assurance that no shells were executed as part of
  24 command substitution with WRDE_NOCMD in effect. In addition it doesn't
  25 require libpthread or libdl, instead we use the public implementation
  26 namespace function __register_atfork (already part of the public ABI
  27 for libpthread).
  28
  29 Tested on x86_64 with no regressions.
  30
  31 Conflicts:
  32         ChangeLog
  33         NEWS
  34 ---
  35  ChangeLog            | 266 +++++++++++++++++++++++++++++++++++++++++++++++++++
  36  NEWS                 |  10 ++
  37  posix/wordexp-test.c |  44 +++++++++
  38  posix/wordexp.c      |  16 +---
  39  4 files changed, 324 insertions(+), 12 deletions(-)
  40
  41 diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c
  42 index 4957006..bdd65e4 100644
  43 --- a/posix/wordexp-test.c
  44 +++ b/posix/wordexp-test.c
  45 @@ -27,6 +27,25 @@
  46
  47  #define IFS " \n\t"
  48
  49 +extern void *__dso_handle __attribute__ ((__weak__, __visibility__ ("hidden")));
  50 +extern int __register_atfork (void (*) (void), void (*) (void), void (*) (void), void *);
  51 +
  52 +static int __app_register_atfork (void (*prepare) (void), void (*parent) (void), void (*child) (void))
  53 +{
  54 +  return __register_atfork (prepare, parent, child,
  55 +                           &__dso_handle == NULL ? NULL : __dso_handle);
  56 +}
  57 +
  58 +/* Number of forks seen.  */
  59 +static int registered_forks;
  60 +
  61 +/* For each fork increment the fork count.  */
  62 +static void
  63 +register_fork (void)
  64 +{
  65 +  registered_forks++;
  66 +}
  67 +
  68  struct test_case_struct
  69  {
  70    int retval;
  71 @@ -206,6 +225,12 @@ struct test_case_struct
  72      { WRDE_SYNTAX, NULL, "$((2+))", 0, 0, { NULL, }, IFS },
  73      { WRDE_SYNTAX, NULL, "`", 0, 0, { NULL, }, IFS },
  74      { WRDE_SYNTAX, NULL, "$((010+4+))", 0, 0, { NULL }, IFS },
  75 +    /* Test for CVE-2014-7817. We test 3 combinations of command
  76 +       substitution inside an arithmetic expression to make sure that
  77 +       no commands are executed and error is returned.  */
  78 +    { WRDE_CMDSUB, NULL, "$((`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
  79 +    { WRDE_CMDSUB, NULL, "$((1+`echo 1`))", WRDE_NOCMD, 0, { NULL, }, IFS },
  80 +    { WRDE_CMDSUB, NULL, "$((1+$((`echo 1`))))", WRDE_NOCMD, 0, { NULL, }, IFS },
  81
  82      { -1, NULL, NULL, 0, 0, { NULL, }, IFS },
  83    };
  84 @@ -258,6 +283,15 @@ main (int argc, char *argv[])
  85           return -1;
  86      }
  87
  88 +  /* If we are not allowed to do command substitution, we install
  89 +     fork handlers to verify that no forks happened.  No forks should
  90 +     happen at all if command substitution is disabled.  */
  91 +  if (__app_register_atfork (register_fork, NULL, NULL) != 0)
  92 +    {
  93 +      printf ("Failed to register fork handler.\n");
  94 +      return -1;
  95 +    }
  96 +
  97    for (test = 0; test_case[test].retval != -1; test++)
  98      if (testit (&test_case[test]))
  99        ++fail;
 100 @@ -367,6 +401,9 @@ testit (struct test_case_struct *tc)
 101
 102    printf ("Test %d (%s): ", ++tests, tc->words);
 103
 104 +  if (tc->flags & WRDE_NOCMD)
 105 +    registered_forks = 0;
 106 +
 107    if (tc->flags & WRDE_APPEND)
 108      {
 109        /* initial wordexp() call, to be appended to */
 110 @@ -378,6 +415,13 @@ testit (struct test_case_struct *tc)
 111      }
 112    retval = wordexp (tc->words, &we, tc->flags);
 113
 114 +  if ((tc->flags & WRDE_NOCMD)
 115 +      && (registered_forks > 0))
 116 +    {
 117 +         printf ("FAILED fork called for WRDE_NOCMD\n");
 118 +         return 1;
 119 +    }
 120 +
 121    if (tc->flags & WRDE_DOOFFS)
 122        start_offs = sav_we.we_offs;
 123
 124 diff --git a/posix/wordexp.c b/posix/wordexp.c
 125 index 366ec18..36a1367 100644
 126 --- a/posix/wordexp.c
 127 +++ b/posix/wordexp.c
 128 @@ -893,6 +893,10 @@ exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 129    pid_t pid;
 130    int noexec = 0;
 131
 132 +  /* Do nothing if command substitution should not succeed.  */
 133 +  if (flags & WRDE_NOCMD)
 134 +    return WRDE_CMDSUB;
 135 +
 136    /* Don't fork() unless necessary */
 137    if (!comm || !*comm)
 138      return 0;
 139 @@ -2082,9 +2086,6 @@ parse_dollars (char **word, size_t *word_length, size_t *max_length,
 140             }
 141         }
 142
 143 -      if (flags & WRDE_NOCMD)
 144 -       return WRDE_CMDSUB;
 145 -
 146        (*offset) += 2;
 147        return parse_comm (word, word_length, max_length, words, offset, flags,
 148                          quoted? NULL : pwordexp, ifs, ifs_white);
 149 @@ -2196,9 +2197,6 @@ parse_dquote (char **word, size_t *word_length, size_t *max_length,
 150           break;
 151
 152         case '`':
 153 -         if (flags & WRDE_NOCMD)
 154 -           return WRDE_CMDSUB;
 155 -
 156           ++(*offset);
 157           error = parse_backtick (word, word_length, max_length, words,
 158                                   offset, flags, NULL, NULL, NULL);
 159 @@ -2357,12 +2355,6 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
 160         break;
 161
 162        case '`':
 163 -       if (flags & WRDE_NOCMD)
 164 -         {
 165 -           error = WRDE_CMDSUB;
 166 -           goto do_error;
 167 -         }
 168 -
 169         ++words_offset;
 170         error = parse_backtick (&word, &word_length, &max_length, words,
 171                                 &words_offset, flags, pwordexp, ifs,
 172 --
 173 2.2.1
 174