Bug 2166544

Summary: shadow-utils: uncontrolled process operation may result in a null pointer dereference
Product: [Other] Security Response Reporter: Sandipan Roy <saroy>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ipedrosa, pbrezina
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
An uncontrolled process operation was found in the newgrp command provided by the shadow-utils package. This issue could cause the execution of arbitrary code provided by a user when running the newgrp command.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2023-02-08 07:28:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2166545, 2166546, 2166547, 2166548, 2166549, 2166550    
Bug Blocks: 2166312    

Description Sandipan Roy 2023-02-02 06:02:12 UTC 
In variadic functions we still do the cast. In POSIX, it's not necessary, since NULL is required to be of type 'void *', and 'void *' is guaranteed to have the same alignment and representation as 'char *'. However, since ISO C still doesn't mandate that, and moreover they're doing dubious stuff by adding nullptr, let's be on the cautious side. Also, C++ requires that NULL is not 'void *', but either plain 0 or some magic stuff.

Reference:

https://github.com/shadow-maint/shadow/pull/642
https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/
Comment 1 Sandipan Roy 2023-02-02 06:09:17 UTC 
Created shadow-utils tracking bugs for this issue:

Affects: fedora-36 [bug 2166547]
Affects: fedora-37 [bug 2166548]
Comment 3 Marian Rehak 2023-02-20 14:52:52 UTC 
CVE-2023-0634 rejected now removing from flaw