Path: csiph.com!goblin1!goblin.stu.neva.ru!usenet.stanford.edu!not-for-mail
From: Eduardo Bustamante <dualbus@gmail.com>
Newsgroups: gnu.bash.bug
Subject: Re: Use-After-Free in Bash
Date: Tue, 30 Oct 2018 18:19:34 -0700
Lines: 17
Approved: bug-bash@gnu.org
Message-ID: <mailman.3143.1540948790.1284.bug-bash@gnu.org>
References: <CALQDDJ90PG3c957jWTp_XE6-h_-1OdjTpeGhFso=iYtTBfyoNg@mail.gmail.com>
NNTP-Posting-Host: lists.gnu.org
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Cc: bug-bash <bug-bash@gnu.org>
To: corbin.souffrant@gmail.com
Envelope-to: bug-bash@gnu.org
In-Reply-To: <CALQDDJ90PG3c957jWTp_XE6-h_-1OdjTpeGhFso=iYtTBfyoNg@mail.gmail.com>
Precedence: list
Xref: csiph.com gnu.bash.bug:14748

On Tue, Oct 30, 2018 at 1:03 PM Corbin Souffrant
<corbin.souffrant@gmail.com> wrote:
(...)
> I found a reproducible use-after-free in every version of Bash from
> 4.4-5.0beta, that could potentially be used to escape restricted mode. I
> say potentially, because I can get it to crash in restricted mode, but I
> haven't gone through the effort of attempting to heap spray to overwrite
> function pointers.

Disclaimer: I'm not a maintainer.

Did you check the `devel' branch in the git repository?

I don't think the restricted mode is really advertised as a powerful
security feature, so IMO you should be able to report it here. If
you're worried though, you can always email Chet Ramey directly.