Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > gnu.bash.bug > #14750 > unrolled thread

Re: Use-After-Free in Bash

Back to article view | Back to gnu.bash.bug

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Use-After-Free in Bash Chet Ramey <chet.ramey@case.edu> - 2018-10-30 21:47 -0400

#14750 — Re: Use-After-Free in Bash

On 10/30/18 9:19 PM, Eduardo Bustamante wrote:
> On Tue, Oct 30, 2018 at 1:03 PM Corbin Souffrant
> <corbin.souffrant@gmail.com> wrote:
> (...)
>> I found a reproducible use-after-free in every version of Bash from
>> 4.4-5.0beta, that could potentially be used to escape restricted mode. I
>> say potentially, because I can get it to crash in restricted mode, but I
>> haven't gone through the effort of attempting to heap spray to overwrite
>> function pointers.
> 
> Disclaimer: I'm not a maintainer.
> 
> Did you check the `devel' branch in the git repository?

He did; I just fixed it today.

> I don't think the restricted mode is really advertised as a powerful
> security feature, so IMO you should be able to report it here. If
> you're worried though, you can always email Chet Ramey directly.

I looked at it and can't see how to exploit it to execute arbitrary code.
It's also only a problem if you're not using the bash malloc.


Chet
-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
		 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    chet@case.edu    http://tiswww.cwru.edu/~chet/

[toc] | [standalone]

Back to top | Article view | gnu.bash.bug

csiph-web