Resolves: CVE-2021-45444 - do not perform PROMPT_SUBST evaluation on %F/%K arguments
This commit is contained in:
Kamil Dudka
parent
b2dac3124a
commit
99ea9dd58b
109
0002-zsh-5.8-CVE-2021-45444.patch
Normal file
109
0002-zsh-5.8-CVE-2021-45444.patch
Normal file
@ -0,0 +1,109 @@
|
||||
From 02e0f94fff27cad2ba4e65bdc4b21146b3bd9a97 Mon Sep 17 00:00:00 2001
|
||||
From: Oliver Kiddle <opk@zsh.org>
|
||||
Date: Wed, 15 Dec 2021 01:56:40 +0100
|
||||
Subject: [PATCH 1/2] security/41: Don't perform PROMPT_SUBST evaluation on
|
||||
%F/%K arguments
|
||||
|
||||
Mitigates CVE-2021-45444
|
||||
|
||||
Upstream-commit: c187154f47697cdbf822c2f9d714d570ed4a0fd1
|
||||
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||
---
|
||||
Src/prompt.c | 10 ++++++++++
|
||||
1 file changed, 10 insertions(+)
|
||||
|
||||
diff --git a/Src/prompt.c b/Src/prompt.c
|
||||
index b65bfb8..91e21c8 100644
|
||||
--- a/Src/prompt.c
|
||||
+++ b/Src/prompt.c
|
||||
@@ -244,6 +244,12 @@ parsecolorchar(zattr arg, int is_fg)
|
||||
bv->fm += 2; /* skip over F{ */
|
||||
if ((ep = strchr(bv->fm, '}'))) {
|
||||
char oc = *ep, *col, *coll;
|
||||
+ int ops = opts[PROMPTSUBST], opb = opts[PROMPTBANG];
|
||||
+ int opp = opts[PROMPTPERCENT];
|
||||
+
|
||||
+ opts[PROMPTPERCENT] = 1;
|
||||
+ opts[PROMPTSUBST] = opts[PROMPTBANG] = 0;
|
||||
+
|
||||
*ep = '\0';
|
||||
/* expand the contents of the argument so you can use
|
||||
* %v for example */
|
||||
@@ -252,6 +258,10 @@ parsecolorchar(zattr arg, int is_fg)
|
||||
arg = match_colour((const char **)&coll, is_fg, 0);
|
||||
free(col);
|
||||
bv->fm = ep;
|
||||
+
|
||||
+ opts[PROMPTSUBST] = ops;
|
||||
+ opts[PROMPTBANG] = opb;
|
||||
+ opts[PROMPTPERCENT] = opp;
|
||||
} else {
|
||||
arg = match_colour((const char **)&bv->fm, is_fg, 0);
|
||||
if (*bv->fm != '}')
|
||||
--
|
||||
2.34.1
|
||||
|
||||
|
||||
From 6102afb5dfd7c704f9cf99bedb9c3ec3c7dbe8e3 Mon Sep 17 00:00:00 2001
|
||||
From: dana <dana@dana.is>
|
||||
Date: Tue, 21 Dec 2021 13:13:33 -0600
|
||||
Subject: [PATCH 2/2] CVE-2021-45444: Update NEWS/README
|
||||
|
||||
Upstream-commit: bdc4d70a7e033b754e68a8659a037ea0fc5f38de
|
||||
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||
---
|
||||
NEWS | 20 ++++++++++++++++++++
|
||||
README | 6 ++++++
|
||||
2 files changed, 26 insertions(+)
|
||||
|
||||
diff --git a/NEWS b/NEWS
|
||||
index 964e163..327b449 100644
|
||||
--- a/NEWS
|
||||
+++ b/NEWS
|
||||
@@ -4,6 +4,26 @@ CHANGES FROM PREVIOUS VERSIONS OF ZSH
|
||||
|
||||
Note also the list of incompatibilities in the README file.
|
||||
|
||||
+Changes since 5.8
|
||||
+-----------------
|
||||
+
|
||||
+CVE-2021-45444: Some prompt expansion sequences, such as %F, support
|
||||
+'arguments' which are themselves expanded in case they contain colour
|
||||
+values, etc. This additional expansion would trigger PROMPT_SUBST
|
||||
+evaluation, if enabled. This could be abused to execute code the user
|
||||
+didn't expect. e.g., given a certain prompt configuration, an attacker
|
||||
+could trick a user into executing arbitrary code by having them check
|
||||
+out a Git branch with a specially crafted name.
|
||||
+
|
||||
+This is fixed in the shell itself by no longer performing PROMPT_SUBST
|
||||
+evaluation on these prompt-expansion arguments.
|
||||
+
|
||||
+Users who are concerned about an exploit but unable to update their
|
||||
+binaries may apply the partial work-around described in the file
|
||||
+Etc/CVE-2021-45444-VCS_Info-workaround.patch included with the shell
|
||||
+source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to
|
||||
+Marc Cornellà <hello@mcornella.com>. ]
|
||||
+
|
||||
Changes since 5.7.1-test-3
|
||||
--------------------------
|
||||
|
||||
diff --git a/README b/README
|
||||
index 7f1dd5f..c9e994a 100644
|
||||
--- a/README
|
||||
+++ b/README
|
||||
@@ -31,6 +31,12 @@ Zsh is a shell with lots of features. For a list of some of these, see the
|
||||
file FEATURES, and for the latest changes see NEWS. For more
|
||||
details, see the documentation.
|
||||
|
||||
+Incompatibilities since 5.8
|
||||
+---------------------------
|
||||
+
|
||||
+PROMPT_SUBST expansion is no longer performed on arguments to prompt-
|
||||
+expansion sequences such as %F.
|
||||
+
|
||||
Incompatibilities since 5.7.1
|
||||
-----------------------------
|
||||
|
||||
--
|
||||
2.34.1
|
||||
|
||||
8
zsh.spec
8
zsh.spec
@ -1,7 +1,7 @@
|
||||
Summary: Powerful interactive shell
|
||||
Name: zsh
|
||||
Version: 5.8
|
||||
Release: 8%{?dist}
|
||||
Release: 9%{?dist}
|
||||
License: MIT
|
||||
URL: http://zsh.sourceforge.net/
|
||||
Source0: https://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.xz
|
||||
@ -15,6 +15,9 @@ Source6: dotzshrc
|
||||
# complete file arguments after rpmbuild -r/-b/-t
|
||||
Patch1: 0001-zsh-5.8-comp-rpm.patch
|
||||
|
||||
# do not perform PROMPT_SUBST evaluation on %F/%K arguments (CVE-2021-45444)
|
||||
Patch2: 0002-zsh-5.8-CVE-2021-45444.patch
|
||||
|
||||
BuildRequires: autoconf
|
||||
BuildRequires: coreutils
|
||||
BuildRequires: gawk
|
||||
@ -158,6 +161,9 @@ fi
|
||||
%doc Doc/*.html
|
||||
|
||||
%changelog
|
||||
* Tue Feb 22 2022 Kamil Dudka <kdudka@redhat.com> - 5.8-9
|
||||
- do not perform PROMPT_SUBST evaluation on %F/%K arguments (CVE-2021-45444)
|
||||
|
||||
* Thu Nov 25 2021 Debarshi Ray <rishi@fedoraproject.org> - 5.8-8
|
||||
- Overwrite PROMPT only if it's set to the built-in default (#2026749)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user