InfoSect's Month of Pointless Bugs (#8)


Dr Silvio Cesare

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #8

In bsdgames/hack, dropping privs can potentially fail similar to Bug #3 http://blog.infosectcbr.com.au/2018/02/infosects-month-of-pointless-bugs-3.html

bsdgames/hack/hack.pager.c int child(int wt) { int status; int f; f = fork(); if (f == 0) { /* child */ settty((char *) 0); /* also calls end_screen() */ (void) setuid(getuid()); (void) setgid(getgid()); +++ doesn't check for errors ... #ifdef UNIX #ifdef SHELL int dosh() { char *str; if (child(0)) { if ((str = getenv("SHELL")) != NULL) execl(str, str, (char *) 0); else execl("/bin/sh", "sh", (char *) 0); pline("sh: cannot execute."); exit(1); } return (0); } #endif /* SHELL */

Popular posts from this blog

Pointer Compression in V8

C++ Memory Corruption (std::string) - part 4

C++ Memory Corruption (std::vector) - part 2