CVE-2016-9401: Use After Free
A vulnerability was found in popd. It can be tricked to free a user supplied address in the following way:
$ popd +-111111
This could be used to bypass restricted shells (rsh) on some environments to cause use-after-free.
References:
http://seclists.org/oss-sec/2016/q4/445
Other sources
popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9401?
CVE-2016-9401 is considered a moderate severity vulnerability because it can be exploited to cause a use-after-free condition.
How do I fix CVE-2016-9401?
To fix CVE-2016-9401, users should update to a patched version of GNU Bash that includes the security fix.
What types of systems are affected by CVE-2016-9401?
CVE-2016-9401 affects GNU Bash versions prior to 4.4 and specific patched versions of 4.4.
What are the potential impacts of CVE-2016-9401?
Exploitation of CVE-2016-9401 could allow an attacker to bypass restricted shells and execute unauthorized commands.
What versions of GNU Bash are safe from CVE-2016-9401?
Versions of GNU Bash that have been patched after 4.4 or any version higher than 4.4 are safe from CVE-2016-9401.