An heap-based buffer overflow was discovered in bash, between versions 4.2 and 4.3, in function lib/sh/strtrans.c:ansicstr() caused by a wrong handling of unsupported characters in u32cconv(). When LC_CTYPE locale cannot correctly convert a wide character to a multibyte sequence, through the wctomb() function, u32cconv() returns a negative value that is used to update a pointer to a buffer in ansicstr(), resulting in a write out of the buffer's bounds. A local attacker, who can provide data to print through the `echo` builtin function, may use this flaw crash a script or execute code with the privileges of the bash process (e.g. escape a restricted bash or elevate privileges if a setuid script is vulnerable). Upstream Patch: http://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=863d31ae775d56b785dc5b0105b6d251515d81d5 (in particular the changes to the u32cconv() function are relevant for this flaw)
Setting Attack Complexity (AC) to High (H) as it's required to use the `echo` built-in function with the `-e` option, which allows you to print unicode characters given the right bytes values. Moreover, restricted bash is not such a used feature and it is not generally considered a security feature as there are many ways to escape it.
Acknowledgments: Name: Erez Turjeman
u32cconv() should return the number of bytes written to the destination buffer and its return value is used to update a pointer in ansicstr(). However, when the locale set in LC_CTYPE does not support some wide character, the wctomb() function returns -1. In vulnerable versions, u32cconv() directly returns the negative value returned by wctomb(), which allows an attacker to move the buffer pointer before the allocated memory, overwriting other data in memory.
Created bash tracking bugs for this issue: Affects: fedora-all [bug 1721852]
Statement: Impact set to Moderate as the flaw requires the usage of `echo -e` built-in function with a string controlled by the attacker. Abusing this flaw would allow an attacker to, at most, execute code with the privileges of the bash process, which could be used e.g. to escape a restricted shell in case of a local attacker scenario or remotely execute code in case of a bash script that accepts untrusted input from the network. However we do not recommend to use bash scripts to handle untrusted data from the network.