From 02e0f94fff27cad2ba4e65bdc4b21146b3bd9a97 Mon Sep 17 00:00:00 2001 From: Oliver Kiddle Date: Wed, 15 Dec 2021 01:56:40 +0100 Subject: [PATCH 1/2] security/41: Don't perform PROMPT_SUBST evaluation on %F/%K arguments Mitigates CVE-2021-45444 Upstream-commit: c187154f47697cdbf822c2f9d714d570ed4a0fd1 Signed-off-by: Kamil Dudka --- Src/prompt.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/Src/prompt.c b/Src/prompt.c index b65bfb8..91e21c8 100644 --- a/Src/prompt.c +++ b/Src/prompt.c @@ -244,6 +244,12 @@ parsecolorchar(zattr arg, int is_fg) bv->fm += 2; /* skip over F{ */ if ((ep = strchr(bv->fm, '}'))) { char oc = *ep, *col, *coll; + int ops = opts[PROMPTSUBST], opb = opts[PROMPTBANG]; + int opp = opts[PROMPTPERCENT]; + + opts[PROMPTPERCENT] = 1; + opts[PROMPTSUBST] = opts[PROMPTBANG] = 0; + *ep = '\0'; /* expand the contents of the argument so you can use * %v for example */ @@ -252,6 +258,10 @@ parsecolorchar(zattr arg, int is_fg) arg = match_colour((const char **)&coll, is_fg, 0); free(col); bv->fm = ep; + + opts[PROMPTSUBST] = ops; + opts[PROMPTBANG] = opb; + opts[PROMPTPERCENT] = opp; } else { arg = match_colour((const char **)&bv->fm, is_fg, 0); if (*bv->fm != '}') -- 2.34.1 From 6102afb5dfd7c704f9cf99bedb9c3ec3c7dbe8e3 Mon Sep 17 00:00:00 2001 From: dana Date: Tue, 21 Dec 2021 13:13:33 -0600 Subject: [PATCH 2/2] CVE-2021-45444: Update NEWS/README Upstream-commit: bdc4d70a7e033b754e68a8659a037ea0fc5f38de Signed-off-by: Kamil Dudka --- NEWS | 20 ++++++++++++++++++++ README | 6 ++++++ 2 files changed, 26 insertions(+) diff --git a/NEWS b/NEWS index 964e163..327b449 100644 --- a/NEWS +++ b/NEWS @@ -4,6 +4,26 @@ CHANGES FROM PREVIOUS VERSIONS OF ZSH Note also the list of incompatibilities in the README file. +Changes since 5.8 +----------------- + +CVE-2021-45444: Some prompt expansion sequences, such as %F, support +'arguments' which are themselves expanded in case they contain colour +values, etc. This additional expansion would trigger PROMPT_SUBST +evaluation, if enabled. This could be abused to execute code the user +didn't expect. e.g., given a certain prompt configuration, an attacker +could trick a user into executing arbitrary code by having them check +out a Git branch with a specially crafted name. + +This is fixed in the shell itself by no longer performing PROMPT_SUBST +evaluation on these prompt-expansion arguments. + +Users who are concerned about an exploit but unable to update their +binaries may apply the partial work-around described in the file +Etc/CVE-2021-45444-VCS_Info-workaround.patch included with the shell +source. [ Reported by RyotaK . Additional thanks to +Marc Cornellà . ] + Changes since 5.7.1-test-3 -------------------------- diff --git a/README b/README index 7f1dd5f..c9e994a 100644 --- a/README +++ b/README @@ -31,6 +31,12 @@ Zsh is a shell with lots of features. For a list of some of these, see the file FEATURES, and for the latest changes see NEWS. For more details, see the documentation. +Incompatibilities since 5.8 +--------------------------- + +PROMPT_SUBST expansion is no longer performed on arguments to prompt- +expansion sequences such as %F. + Incompatibilities since 5.7.1 ----------------------------- -- 2.34.1