NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

kern/56673: don't allow execve with NULL argv



>Number:         56673
>Category:       kern
>Synopsis:       don't allow execve with NULL argv
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 26 15:55:01 +0000 2022
>Originator:     Jan Schaumann
>Release:        
>Organization:
	
>Description:

As illustrated on Linux by e.g., https://seclists.org/oss-sec/2022/q1/80,
calling execve(2) with a NULL argv can have unexpected consequences.

OpenBSD, for example, does not permit exexcve with a NULL argv, but NetBSD
does.

I'd suggest to fail if the argv is NULL.

>How-To-Repeat:

$ cat <<EOF >a.c
#include <stdlib.h>
#include <unistd.h>

int main() {
	char *argv[]={ NULL };
	char *envp[]={ NULL };
	execve("/bin/sh", argv, envp);
	exit(42);
}
EOF
$ cc a.c
$ ./a.out

	
>Fix:
	



Home | Main Index | Thread Index | Old Index