Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > gnu.bash.bug > #14747 > unrolled thread

Use-After-Free in Bash

Back to article view | Back to gnu.bash.bug

Contents

  Use-After-Free in Bash Corbin Souffrant <corbin.souffrant@gmail.com> - 2018-10-30 12:31 -0700

#14747 — Use-After-Free in Bash

Hello,

I found a reproducible use-after-free in every version of Bash from
4.4-5.0beta, that could potentially be used to escape restricted mode. I
say potentially, because I can get it to crash in restricted mode, but I
haven't gone through the effort of attempting to heap spray to overwrite
function pointers.

I read in previous threads that you don't consider most crashes in Bash to
be security issues, but before I posted something to the public mailing
list, I wanted to be sure that this was the correct place to do so. If not,
who should I email? I have a writeup, with repro and patch that I think
should work. :)

Thanks!
Corbin Souffrant

[toc] | [standalone]

Back to top | Article view | gnu.bash.bug

csiph-web