Bug 1721071 (CVE-2012-6711)

Summary:	CVE-2012-6711 bash: heap-based buffer overflow during echo of unsupported characters
Product:	[Other] Security Response	Reporter:	Riccardo Schirone <rschiron>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	admiller, aprajapa, kasal, kdudka, msweiker, security-response-team, svashisht
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	bash 4.3	Doc Type:	If docs needed, set a value
Doc Text:	A heap-based buffer overflow was discovered in bash when wide characters, not supported by the current locale set in LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the `echo -e` built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-27 03:29:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1721851, 1721852
Bug Blocks:	1710592

Description Riccardo Schirone 2019-06-17 09:15:34 UTC

An heap-based buffer overflow was discovered in bash, between versions 4.2 and 4.3, in function lib/sh/strtrans.c:ansicstr() caused by a wrong handling of unsupported characters in u32cconv(). When LC_CTYPE locale cannot correctly convert a wide character to a multibyte sequence, through the wctomb() function, u32cconv() returns a negative value that is used to update a pointer to a buffer in ansicstr(), resulting in a write out of the buffer's bounds. A local attacker, who can provide data to print through the `echo` builtin function, may use this flaw crash a script or execute code with the privileges of the bash process (e.g. escape a restricted bash or elevate privileges if a setuid script is vulnerable).

Upstream Patch:
http://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=863d31ae775d56b785dc5b0105b6d251515d81d5 (in particular the changes to the u32cconv() function are relevant for this flaw)

Comment 1 Riccardo Schirone 2019-06-17 10:42:06 UTC

Setting Attack Complexity (AC) to High (H) as it's required to use the `echo` built-in function with the `-e` option, which allows you to print unicode characters given the right bytes values. Moreover, restricted bash is not such a used feature and it is not generally considered a security feature as there are many ways to escape it.

Comment 2 Riccardo Schirone 2019-06-18 12:59:16 UTC

Acknowledgments:

Name: Erez Turjeman

Comment 4 Riccardo Schirone 2019-06-19 07:17:37 UTC

u32cconv() should return the number of bytes written to the destination buffer and its return value is used to update a pointer in ansicstr(). However, when the locale set in LC_CTYPE does not support some wide character, the wctomb() function returns -1. In vulnerable versions, u32cconv() directly returns the negative value returned by wctomb(), which allows an attacker to move the buffer pointer before the allocated memory, overwriting other data in memory.

Comment 6 Riccardo Schirone 2019-06-19 07:19:31 UTC

Created bash tracking bugs for this issue:

Affects: fedora-all [bug 1721852]

Comment 8 Riccardo Schirone 2020-04-23 15:55:35 UTC

Statement:

Impact set to Moderate as the flaw requires the usage of `echo -e` built-in function with a string controlled by the attacker. Abusing this flaw would allow an attacker to, at most, execute code with the privileges of the bash process, which could be used e.g. to escape a restricted shell in case of a local attacker scenario or remotely execute code in case of a bash script that accepts untrusted input from the network. However we do not recommend to use bash scripts to handle untrusted data from the network.