Bug 1354386 (CVE-2016-6185)

Summary: CVE-2016-6185 perl: XSLoader loads relative paths not included in @INC
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: carnil, cbuissar, cweyl, hhorak, iarnell, jorton, jplesnik, kasal, perl-devel, perl-maint-list, ppisar, psabata, rc040203, rmeggins, sardella, tcallawa
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: perl 5.25.3 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-04 11:29:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1353238, 1354387    
Bug Blocks: 1354390    

Description Adam Mariš 2016-07-11 08:29:31 UTC 
An arbitrary code execution can be achieved if loading code from untrusted current working directory despite the '.' is removed from @INC. Vulnerability is in XSLoader that uses caller() information to locate .so file to load. If malicious attacker creates directory named `(eval 1)` with malicious binary file in it, it will be loaded if the package calling XSLoader is in parent directory.

CVE assignment:

http://seclists.org/oss-sec/2016/q3/28

Upstream bug:

https://rt.cpan.org/Public/Bug/Display.html?id=115808

Upstream patch:

http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7
Comment 1 Adam Mariš 2016-07-11 08:30:06 UTC 
Created perl tracking bugs for this issue:

Affects: fedora-all [bug 1354387]
Comment 2 Fedora Update System 2016-07-15 18:21:23 UTC 
perl-5.20.3-332.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2016-07-18 18:24:35 UTC 
perl-5.22.2-361.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2016-07-18 20:52:42 UTC 
perl-5.22.2-353.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.