Message ID | 0b5ba565-c599-6095-9300-09e2e3cba997@gmail.com |
---|---|
State | Accepted |
Delegated to: | John Crispin |
Headers | show |
Series | [LEDE-DEV] Patch FS#1181 - CVE-2017-16544: A Busybox autocompletion vulnerability | expand |
diff --git a/libbb/lineedit.c b/libbb/lineedit.c index 3e62f46..34538aa 100644 --- a/libbb/lineedit.c +++ b/libbb/lineedit.c @@ -632,6 +632,18 @@ static void free_tab_completion_data(void) static void add_match(char *matched) { + unsigned char *p = (unsigned char*)matched; + while (*p) { + /* ESC attack fix: drop any string with control chars */ + if (*p < ' ' + || (!ENABLE_UNICODE_SUPPORT && *p >= 0x7f) + || (ENABLE_UNICODE_SUPPORT && *p == 0x7f) + ) { + free(matched); + return; + } + p++; + } matches = xrealloc_vector(matches, 4, num_matches); matches[num_matches] = matched; num_matches++;
Date: Thu, 28 Dec 2017 10:32:09 -0500 Subject: [PATCH] In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks. Fixes: FS#1181 - CVE-2017-16544: Backport the patch from: https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8 https://nvd.nist.gov/vuln/detail/CVE-2017-16544 Signed-off-by: Derek Werthmuller <thewerthfam@gmail.com> --- libbb/lineedit.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)