Bug 1721071 (CVE-2012-6711) - CVE-2012-6711 bash: heap-based buffer overflow during echo of unsupported characters
Summary: CVE-2012-6711 bash: heap-based buffer overflow during echo of unsupported cha...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-6711
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1721851 1721852
Blocks: 1710592
TreeView+ depends on / blocked
 
Reported: 2019-06-17 09:15 UTC by Riccardo Schirone
Modified: 2022-01-07 06:10 UTC (History)
7 users (show)

Fixed In Version: bash 4.3
Doc Type: If docs needed, set a value
Doc Text:
A heap-based buffer overflow was discovered in bash when wide characters, not supported by the current locale set in LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the `echo -e` built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process.
Clone Of:
Environment:
Last Closed: 2021-10-27 03:29:32 UTC


Attachments (Terms of Use)

Description Riccardo Schirone 2019-06-17 09:15:34 UTC
An heap-based buffer overflow was discovered in bash, between versions 4.2 and 4.3, in function lib/sh/strtrans.c:ansicstr() caused by a wrong handling of unsupported characters in u32cconv(). When LC_CTYPE locale cannot correctly convert a wide character to a multibyte sequence, through the wctomb() function, u32cconv() returns a negative value that is used to update a pointer to a buffer in ansicstr(), resulting in a write out of the buffer's bounds. A local attacker, who can provide data to print through the `echo` builtin function, may use this flaw crash a script or execute code with the privileges of the bash process (e.g. escape a restricted bash or elevate privileges if a setuid script is vulnerable).

Upstream Patch:
http://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=863d31ae775d56b785dc5b0105b6d251515d81d5 (in particular the changes to the u32cconv() function are relevant for this flaw)

Comment 1 Riccardo Schirone 2019-06-17 10:42:06 UTC
Setting Attack Complexity (AC) to High (H) as it's required to use the `echo` built-in function with the `-e` option, which allows you to print unicode characters given the right bytes values. Moreover, restricted bash is not such a used feature and it is not generally considered a security feature as there are many ways to escape it.

Comment 2 Riccardo Schirone 2019-06-18 12:59:16 UTC
Acknowledgments:

Name: Erez Turjeman

Comment 4 Riccardo Schirone 2019-06-19 07:17:37 UTC
u32cconv() should return the number of bytes written to the destination buffer and its return value is used to update a pointer in ansicstr(). However, when the locale set in LC_CTYPE does not support some wide character, the wctomb() function returns -1. In vulnerable versions, u32cconv() directly returns the negative value returned by wctomb(), which allows an attacker to move the buffer pointer before the allocated memory, overwriting other data in memory.

Comment 6 Riccardo Schirone 2019-06-19 07:19:31 UTC
Created bash tracking bugs for this issue:

Affects: fedora-all [bug 1721852]

Comment 8 Riccardo Schirone 2020-04-23 15:55:35 UTC
Statement:

Impact set to Moderate as the flaw requires the usage of `echo -e` built-in function with a string controlled by the attacker. Abusing this flaw would allow an attacker to, at most, execute code with the privileges of the bash process, which could be used e.g. to escape a restricted shell in case of a local attacker scenario or remotely execute code in case of a bash script that accepts untrusted input from the network. However we do not recommend to use bash scripts to handle untrusted data from the network.


Note You need to log in before you can comment on or make changes to this bug.