CVE-2014-4043: Code Injection

posixspawnfileactionsaddopen in glibc fails to copy the path argument. Per the specification (http://pubs.opengroup.org/onlinepubs/000095399/functions/posixspawnfileactionsaddclose.html) it is supposed to. The result of not copying is that programs can easily trigger use-after-free bugs, or other situations where the path is mutated. The following program demonstrates this issue:

#include <string.h> #include <assert.h> #include <fcntl.h> #include <unistd.h> #include <sys/types.h> #include <sys/wait.h> #include <stdlib.h> #include <spawn.h> #include <stdio.h>

extern char const environ;

int main() { int res; posixspawnfileactionst fa; posixspawnfileactionsinit(&fa);

char origpath = "/tmp/afddsa"; char path = malloc(strlen(origpath) + 1); strcpy(path, origpath); path[strlen(origpath)] = '\0';

res = posixspawnfileactionsaddopen( &fa, 1, path, OWRONLY | OCREAT, SIRUSR | SIWUSR); assert(res == 0);

memset(path, 0, strlen(origpath)); free(path);

char argv[] = {"/bin/echo", NULL}; pidt pid; res = posixspawn( &pid, "/bin/echo", &fa, NULL, argv, environ ); assert(res == 0); int status; wait4(pid, &status, 0, NULL); printf("%d\n", WEXITSTATUS(status)); }

This bug was jointly discovered by David Reid, Alex Gaynor, and Glyph Lefkowitz.

Issue is fixed in glibc 2.20: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=89e435f3559c53084498e9baad22172b64429362 Recommended additional commit for backporting: https://sourceware.org/git/?p=glibc.git;a=commit;h=35a5e3e338ae17f3d42c6

External references:

https://sourceware.org/bugzilla/showbug.cgi?id=17048