bugGNU Octave - Bugs: bug #62872, mkoctfile potentially executes...

 
 

bug #62872: mkoctfile potentially executes uncontrolled commands

Submitter:  Markus Mützel <mmuetzel>
Submitted:  Sun 07 Aug 2022 09:23:04 AM UTC
   
 
Category:  Other Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Need Info Assigned to:  None
Originator Name:  Open/Closed:  * Open
Release:  * dev Operating System:  * Any
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 02 Sep 2022 02:52:08 PM UTC, comment #1: 

I closed those alerts on GitHub as "won't fix".

Keeping this open in case anyone has an idea how the security risk could be mitigated.

Please, feel free to close if you think we shouldn't bother.

Markus Mützel <mmuetzel>
Group administrator
Sun 07 Aug 2022 09:23:04 AM UTC, original submission:  

GitHub's CodeQL identified a couple of places in `mkoctfile.cc` that might lead to uncontrolled commands being executed:
https://github.com/gnu-octave/octave/security/code-scanning/31
https://github.com/gnu-octave/octave/security/code-scanning/32
https://github.com/gnu-octave/octave/security/code-scanning/33

`mkoctfile.cc` is generated from `mkoctfile.cc.in`. Afaict, the corresponding lines in that source are:
https://hg.savannah.gnu.org/hgweb/octave/file/7f4ad92265d2/src/mkoctfile.in.cc#l596
https://hg.savannah.gnu.org/hgweb/octave/file/7f4ad92265d2/src/mkoctfile.in.cc#l1151
https://hg.savannah.gnu.org/hgweb/octave/file/7f4ad92265d2/src/mkoctfile.in.cc#l1091

IIUC, the concern raised is that the commands that are being executed are potentially constructed from the values of environment variables, and there is no check whether those values are "sane".
That's indeed the case: We allow, e.g., to override the default C++ compiler by setting the environment variable `CXX`. And IIUC, we want to allow that.

Afaict, to "exploit" this a user would need to be able to set environment variables and run commands on the system where `mkoctfile` is running. And, IIUC, the spawned processes will run with the same rights as `mkoctfile`. So, the impact is pretty limited, and anything going wrong might be a "user error" imho.
But, I'd like to hear from others if they think differently.

Markus Mützel <mmuetzel>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mmuetzel (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code