From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 790823858C60; Fri, 21 Jan 2022 11:47:16 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 790823858C60
From: "adrien.devresse at metamorphe dot engineering"
 <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/104161] New: Potential Security Vulnerability: remove_all
 and symbolic link
Date: Fri, 21 Jan 2022 11:47:16 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: unknown
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: adrien.devresse at metamorphe dot engineering
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-104161-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Fri, 21 Jan 2022 11:47:16 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D104161

            Bug ID: 104161
           Summary: Potential Security Vulnerability: remove_all and
                    symbolic link
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: adrien.devresse at metamorphe dot engineering
  Target Milestone: ---

Dear all,

The Rust compiler recently reported a CVE about a vulnerability about the
recursive deletion on the filesystem and the use of symlink.

https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html


Ater a quick check, I do believe the implementation of
std::filesystem::remove_all presents the same vulnerability

https://en.cppreference.com/w/cpp/filesystem/remove

The logic rely on directory_iterator NOT opening symbolic link liked mandat=
ed
by the standard

https://en.cppreference.com/w/cpp/filesystem/directory_iterator


https://github.com/playbar/cpplearn/blob/master/gcc/libstdc%2B%2B-v3/src/c%=
2B%2B17/fs_ops.cc#L1300

However, it seems GCC implementation of directory_iterator does open and fo=
llow
symbolic links when used on it

https://godbolt.org/#z:OYLghAFBqd5QCxAYwPYBMCmBRdBLAF1QCcAaPECAMzwBtMA7AQwF=
tMQByARg9KtQYEAysib0QXACx8BBAKoBnTAAUAHpwAMvAFYTStJg1DIApACYAQuYukl9ZATwDKj=
dAGFUtAK4sGIM9KuADJ4DJgAcj4ARpjE/tIADqgKhE4MHt6%2B8aRJKY4CIWGRLDFxAbaY9vkMQ=
gRMxAQZPn7ldpgOabX1BIUR0bHZCnUNTVmtwz2hfSUDAQCUtqhexMjsHOYAzKHI3lgA1CYbbk5D=
xJish9gmGgCCm9u7mAdHNPQKAJ5DmCyX13dmWwYOy8%2B0Obi8DDwQ3QADoEL9bn9QgQ9iwmKEI=
Mi9vVgMhSHtkAh6gAqYnY4jAABucxMAHYrLc9kyCQIhgSicQ9mSFLRQgBrZ4AEQOZjMAHoCCwEh=
LMENzGZDhYDoiVTdmXsxWKCWcmAQnh8WLyGHy/uq8FQIHsDUa%2BRB5WLMARTKL8Tz%2BXMmWAw=
IdhRoafTTermdCQChYpywWCRWY9lR0bRtedHEYre9DfyDgBWNwMeWKwNBvaYVSECBcGkbBlq5l0=
wV/euM5mavZ6tmEU3XACcIZA4ZIAH00Pt2oqayrO0wvEQ9oQhVaCOhQ69ZZ89SxQ/gzg4SO9%2B=
4RYrqSBA3cb8e0K1WC/PFyglijI0dozF%2BGc9ryhqFgCZs7nRfnxy%2BECTtO5gAGyxnsIAzgQ=
/qXhonZdj2aBTs8bhRlQqFRvK0aYY%2BeY/nmlYNghtJ1o2TJIXeuFuNGTBUHqnLvsmX4EX%2BR=
GIqRfwcAstCcJmvB%2BBwWikKgnBoZY1hWksKxPJsPCkAQmjcQsfIgBsGwwupWnaTpoH6JwkgCU=
pImcLwCggBoClKQscCwEgaBSnQsTkJQDkJE5cTAFwXBmHwdAMeZEBRMZUShPU7ycPJDlsIIADyD=
C0BFQm8FgaJGOIyWkJu7SOJSsrGcW7RTmswnIpUxm8lExDhR4WDGQQxB4Ou3DcXwBjAAoABqeCY=
AA7rFCSMJFvD8IIIhiOwUgyIIigqOomW6Fw%2BiGMY1jWPoeBROZkALKgCTVOZHAALTQj6zpWJY=
XC0mZlQ5WkLgMO4njNHowRTMUpR6LkqQCKMfhLd91S9B9AxLW0HQCF0IzPVkYO3RDNQTMD/RxGD=
Ex/XoQzdMjMyowsCjSasegNZgaw8DxfFGZlokcKoAAcoFHaBkh7LiyB7N5MIxhA4kXTYey4IQJA=
ihsS17B4jn0BGALlrwinJXMKlqRpOmq1pem8RwhmkIJwk02ZFlWQrpC2YgIB3gkU4uRAbkea9%2=
BBEKj03CKI4hTaN8hKGo9VnGTvC9dVCTDRTHD8Trxk07FU6WyiqAYfTjPM6zyDs5z3MS%2B5Usi=
7LRtaIrpCqepmlq6r%2Bla1TeumbYhvy3nIdmBXvD67nymkHlxApM4khAA


Consequently, GCC seems logicially vulnerable to this attack.

Regards,

A.D=