public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/17048] New: posix_spawn_file_actions_addopen fails to copy the path argument
@ 2014-06-11 20:19 alex.gaynor at gmail dot com
  2014-06-11 20:21 ` [Bug libc/17048] " alex.gaynor at gmail dot com
                   ` (11 more replies)
  0 siblings, 12 replies; 13+ messages in thread
From: alex.gaynor at gmail dot com @ 2014-06-11 20:19 UTC (permalink / raw)
  To: glibc-bugs

https://sourceware.org/bugzilla/show_bug.cgi?id=17048

            Bug ID: 17048
           Summary: posix_spawn_file_actions_addopen fails to copy the
                    path argument
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: alex.gaynor at gmail dot com
                CC: drepper.fsp at gmail dot com

Per the specification
(http://pubs.opengroup.org/onlinepubs/000095399/functions/posix_spawn_file_actions_addclose.html)
it is supposed to. The result of not copying is that programs can easily
trigger use-after-free bugs, or other situations where the path is mutated. The
following program demonstrates this issue:

#include <string.h>
#include <assert.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <stdlib.h>
#include <spawn.h>
#include <stdio.h>


extern char *const *environ;

int main() {
    int res;
    posix_spawn_file_actions_t fa;
    posix_spawn_file_actions_init(&fa);

    char *orig_path = "/tmp/afddsa";
    char *path = malloc(strlen(orig_path) + 1);
    strcpy(path, orig_path);
    path[strlen(orig_path)] = '\0';

    res = posix_spawn_file_actions_addopen(
        &fa, 1, path, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
    assert(res == 0);

    memset(path, 0, strlen(orig_path));
    free(path);

    char *argv[] = {"/bin/echo", NULL};
    pid_t pid;
    res = posix_spawn(
        &pid,
        "/bin/echo",
        &fa,
        NULL,
        argv,
        environ
    );
    assert(res == 0);
    int status;
    wait4(pid, &status, 0, NULL);
    printf("%d\n", WEXITSTATUS(status));
}


This bug was jointly discovered by David Reid, Alex Gaynor, and Glyph
Lefkowitz.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 13+ messages in thread
end of thread, other threads:[~2015-02-23 15:02 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-06-11 20:19 [Bug libc/17048] New: posix_spawn_file_actions_addopen fails to copy the path argument alex.gaynor at gmail dot com
2014-06-11 20:21 ` [Bug libc/17048] " alex.gaynor at gmail dot com
2014-06-11 21:18 ` cvs-commit at gcc dot gnu.org
2014-06-11 21:21 ` fweimer at redhat dot com
2014-06-12 13:53 ` fweimer at redhat dot com
2014-06-12 18:47 ` fweimer at redhat dot com
2014-06-13 13:29 ` [Bug libc/17048] posix_spawn_file_actions_addopen fails to copy the path argument (CVE-2014-4043) fweimer at redhat dot com
2014-06-14 23:32 ` cvs-commit at gcc dot gnu.org
2015-01-16 16:59 ` cvs-commit at gcc dot gnu.org
2015-01-16 17:02 ` cvs-commit at gcc dot gnu.org
2015-01-29 18:50 ` cvs-commit at gcc dot gnu.org
2015-02-23 14:23 ` cvs-commit at gcc dot gnu.org
2015-02-23 15:02 ` cvs-commit at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).