A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parseoption() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcpopt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcpopt' and aborts.

On Fri, 20 Oct 2023 at 09:55, Turistu <turistu () gmail com> wrote: [...] It pretty much is mitigated at that layer. If xterm itself weren't filtering out the ESC (ascii 0x1b) character in the pasted data, then the bracketed-paste feature of bash or zsh could've been easily bypassed by inserting a "\x1b[201~" escape (= end of pasted data) in the payload. (As already mentioned in the report too). I haven't tested all terminal and shell combinations, but the implementations of bracketed paste mode vary in their correctness, some do not filter all non-whitespace control characters, so for example you can add ^C into the exploit HTML:

writeXPrimary('\u0003;touch ~/LOL-' + Date.now() / 1000 +'\r')

Then you get a command being run with no interaction; this appears to work with xterm (384) + fish for example. But there are a thousand more ways for an attacker to leverage that hole in Firefox. Many programs (including Firefox itself!) could be easily crashed by garbage data from the clipboard. Attacker-controlled data could find its way into shell scripts via var=$(xsel), etc. This isn't just limited to Firefox, one example is terminals that support OSC 52 (clipboard write), a remote SSH session can be hijacked and an attacker can inject OSC 52 into the stream in the background (I looked into this as part of my terminal security research, see [1]).

As you point out there are many ways for untrusted data to end up on the clipboard, the attack vector here is via the terminal so my opinion is the terminal is what should protect against it. (Although I think Firefox could help with some defense-in-depth here, shame they don't want to.)

For example two terminals that get this right are:

- rxvt-unicode: The confirm-paste extension (loaded in the default set) pops up a confirmation when pasting control characters (not just newlines), "y" will strip controls, "p" will paste controls as is. - Windows Terminal: Strips non-whitespace control characters, asks for confirmation when pasting newlines, if bracketed paste mode is off.

David

[1]: https://dgl.cx/2023/09/ansi-terminal-security#xterm-osc-52-clipboard

Stack-based buffer overflow in the getpacket method in socket.c in dhcpcd 3.2.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long packet.

dhcpcd before 5.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.