bugThe GNU Bourne-Again SHell - Bugs: bug #67323, Fix invalid access by adjusting...

 
 

bug #67323: Fix invalid access by adjusting members of COMMAND and SIMPLE_COM

Submitter:  Florian Schmaus <flow>
Submitted:  Wed 16 Jul 2025 08:53:38 AM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  None Open/Closed:  Open
* Mandatory Fields

Post a Comment

Add a New Comment Rich Markup
   

Discussion

Fri 25 Jul 2025 01:47:13 PM UTC, comment #3: 

Thanks for the alternate approach. We'll give it a try.

Chet Ramey <chet>
Group administrator
Fri 25 Jul 2025 08:02:19 AM UTC, comment #2: 

As discussed elsewhere with the submitter, the description is inaccurate; LP64 does not meet the conditions stated, and yet it works due to how padding happens to make things line up, plus it's not about fat pointers, it's about the size of pointers compared with int (breaking when sizeof(void ) > 2 sizeof(int)). The fix isn't what it should be; the parse.y code in question is still a strict aliasing violation and thus UB, even if this hack to make the object layout line up happens to work with today's compiler. A correct fix would be to make the ternary do something like `$1->type == cm_simple ? &$1->value.Simple->redirects : &$1->redirects;`, giving a `REDIRECT **`, and use `*p` where `tc->redirects` is used today.

Jessica Clarke <jrtc27>
Wed 16 Jul 2025 02:16:48 PM UTC, comment #1: 

Thanks for the report and patch.

Chet Ramey <chet>
Group administrator
Wed 16 Jul 2025 08:53:38 AM UTC, original submission:  

Bash casts SIMPLE_COM* to COMMAND* in certain places and afterward accesses the 'redirects' field (which is declared by both structs). However, the 'redirects' field is only at the same offset assuming that enum, int, and pointers are equal sized. This assumption does not hold for architectures with fat pointers, like CHERI RISC-V, resulting in invalid loads or stores on 'redirects.'

For example, an invalid access can be triggered by the |& operator using CheriBSD:


root@cheribsd-morello-purecap:~ # bash -c 'echo foo |& tee bar'
In-address space security exception (core dumped)


Here, bash casts SIMPLE_COM* to COMMAND* in the BAR_AND case handling at parse.y:1480 and then will dereference the 'redirects' pointer on the wrong offset. The resulting load does not yield a valid pointer, triggering a CHERI fault.

Fix this by aligning the declaration order of the shared members of the two structs, enabling reliable access to the shared members.

Based on the crash analysis of Martin Kaiser. Thanks!

Florian Schmaus <flow>

 

Attached Files

(Note: upload size limit is set to 4.0MiB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by jrtc27 (Posted a comment)
  • -email is unavailable- added by chet (Posted a comment)
  • -email is unavailable- added by flow (Submitted the item)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

    History

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2025-07-16 chet StatusNone Fixed
    2025-07-16 flow Attached File- Added 0001-Fix-invalid-access-by-adjusting-members-of-COMMAND-a.patch, #57417

    Back to the top

    Powered by Savane 3.16-598c.
    Corresponding source code