GNU bug report logs - #12155
24.1; Potential Security Flaw with `enable-local-eval', `enable-local-variables'

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 12155 in the body.
You can then email your comments to 12155 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Paul Ling <pdling <at> btinternet.com>
To: bug-gnu-emacs <at> gnu.org
Subject: 24.1; Potential Security Flaw with `enable-local-eval',
	`enable-local-variables'
Date: Tue, 7 Aug 2012 16:45:05 +0100

--text follows this line--
This bug report will be sent to the Bug-GNU-Emacs mailing list
and the GNU bug tracker at debbugs.gnu.org.  Please check that
the From: line contains a valid email address.  After a delay of up
to one day, you should receive an acknowledgement at that address.

Please write in English if possible, as the Emacs maintainers
usually do not have translators for other languages.

Please describe exactly what actions triggered the bug, and
the precise symptoms of the bug.  If you can, give a recipe
starting from `emacs -Q':

If Emacs crashed, and you have the Emacs process in the gdb debugger,
please include the output from the following gdb commands:
    `bt full' and `xbacktrace'.
For information about debugging Emacs, please read the file
/Applications/MacPorts/Emacs.app/Contents/Resources/etc/DEBUG.

In GNU Emacs 24.1.1 (x86_64-apple-darwin11.3.0, NS apple-appkit-1138.32)
of 2012-06-15 on gamma.local
Windowing system distributor `Apple', version 10.3.1138
Configured using:
`configure '--prefix=/opt/local' '--with-ns' '--without-x'
'--without-dbus' 'CC=/usr/bin/clang' 'CFLAGS=-pipe -O2 -arch x86_64'
'LDFLAGS=-L/opt/local/lib -arch x86_64'
'CPPFLAGS=-I/opt/local/include''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: nil
  value of $XMODIFIERS: nil
  locale-coding-system: nil
  default enable-multibyte-characters: t

Major mode: Help

Minor modes in effect:
  minibuffer-depth-indicate-mode: t
  delete-selection-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
<help-menu> <send-emacs-bug-report>

Recent messages:
Type "q" to delete help window.
Creating customization items...
Creating customization items ...done
Resetting customization items...done
Creating customization setup...done
To install your edits, invoke [State] and choose the Set operation
Type "q" to delete help window.
Back to top level. [2 times]
Type "q" to delete help window.
Copied 17 characters

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr warnings emacsbug message format-spec
rfc822 mml mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mail-utils cus-edit wid-edit pp help-mode hl-line
auctex-autoloads tex-site info package tabulated-list jka-compr mb-depth
linum delsel cua-base cus-start cus-load pdling view tmm electric
dired-x easymenu dired-aux apropos srtmenu poshist ltx-aux dtree dired
regexp-opt pdl-fix-focus advice help-fns advice-preload edmacro kmacro
time-date tooltip ediff-hook vc-hooks lisp-float-type mwheel ns-win
tool-bar dnd fontset image fringe lisp-mode register page menu-bar
rfn-eshadow timer select scroll-bar mouse jit-lock font-lock syntax
facemenu font-core frame cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese hebrew greek romanian slovak
czech european ethiopic indian cyrillic chinese case-table epa-hook
jka-cmpr-hook help simple abbrev minibuffer loaddefs button faces
cus-face files text-properties overlay sha1 md5 base64 format env
code-pages mule custom widget hashtable-print-readable backquote
make-network-process ns multi-tty emacs)

On setting `enable-local-variables' to `:safe' (set safe local
variables, ignore others) and `enable-local-eval' to `maybe' (the
default, should query `eval:'s in local variables), the `eval:'s seem to
get evaluated without querying the user.  For example, with

;; Local Variabulls:
;; eval: (do-something-nasty)
;; End:

at the end of a file (with Variables in place of Variabulls) on opening
the file `(do-something-nasty)' seems to get evaluated with obvious
security issues.

Hope this is helpful and I'm not missing something obvious,
Paul Ling.

Message #14 received at 12155 <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: Paul Ling <pdling <at> btinternet.com>
Cc: 12155 <at> debbugs.gnu.org
Subject: Re: bug#12155: 24.1; Potential Security Flaw with `enable-local-eval',
	`enable-local-variables'
Date: Tue, 07 Aug 2012 14:44:35 -0400

Thanks for the report. This issue is present in 23.2, 23.3, 23.4, 24.1,
and the current trunk, but not in 23.1.

I committed this patch to the emacs-24 branch.
I would appreciate it if others could check this.

This issue should also get an entry in test/automated to stop it recurring.

*** lisp/files.el	2012-07-01 16:38:53 +0000
--- lisp/files.el	2012-08-07 18:41:39 +0000
***************
*** 3107,3117 ****
  	      ;; Obey `enable-local-eval'.
  	      ((eq var 'eval)
  	       (when enable-local-eval
! 		 (push elt all-vars)
! 		 (or (eq enable-local-eval t)
! 		     (hack-one-local-variable-eval-safep (eval (quote val)))
! 		     (safe-local-variable-p var val)
! 		     (push elt unsafe-vars))))
  	      ;; Ignore duplicates (except `mode') in the present list.
  	      ((and (assq var all-vars) (not (eq var 'mode))) nil)
  	      ;; Accept known-safe variables.
--- 3107,3122 ----
  	      ;; Obey `enable-local-eval'.
  	      ((eq var 'eval)
  	       (when enable-local-eval
! 		 (let ((safe (or (hack-one-local-variable-eval-safep
! 				  (eval (quote val)))
! 				 ;; In case previously marked safe (bug#5636).
! 				 (safe-local-variable-p var val))))
! 		   ;; If not safe and e-l-v = :safe, ignore totally.
! 		   (when (or safe (not (eq enable-local-variables :safe)))
! 		     (push elt all-vars)
! 		     (or (eq enable-local-eval t)
! 			 safe
! 			 (push elt unsafe-vars))))))
  	      ;; Ignore duplicates (except `mode') in the present list.
  	      ((and (assq var all-vars) (not (eq var 'mode))) nil)
  	      ;; Accept known-safe variables.

Message #21 received at 12155 <at> debbugs.gnu.org (full text, mbox):

From: Chong Yidong <cyd <at> gnu.org>
To: 12155 <at> debbugs.gnu.org
Subject: [Kurt Seifried] Re: [oss-security] Security flaw in GNU Emacs
	file-local variables
Date: Tue, 14 Aug 2012 11:16:50 +0800

[Message part 1 (message/rfc822, inline)]

From: Kurt Seifried <kseifried <at> redhat.com>
To: oss-security <at> lists.openwall.com
Cc: Chong Yidong <cyd <at> gnu.org>
Subject: Re: [oss-security] Security flaw in GNU Emacs file-local variables
Date: Sun, 12 Aug 2012 23:42:36 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/12/2012 09:22 PM, Chong Yidong wrote:
> Paul Ling has found a security flaw in the file-local variables
> code in GNU Emacs.  We are preparing a new Emacs release to address
> this flaw, and would like to request a CVE.
> 
> When the Emacs user option `enable-local-variables' is set to
> `:safe' (the default value is t), Emacs should automatically refuse
> to evaluate `eval' forms in file-local variable sections.  Due to
> the bug, Emacs instead automatically evaluates such `eval' forms.
> Thus, if the user changes the value of `enable-local-variables' to
> `:safe', visiting a malicious file can cause automatic execution of
> arbitrary Emacs Lisp code with the permissions of the user.
> 
> The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1.
> 
> Attached are patches to fix this bug for Emacs 23.4 and Emacs
> 24.1, written by Glenn Morris.  (The 23.4 patch should apply to the
> rest of the Emacs 23.x series.)
> 
> Bug tracker ref:
> http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155

Please use CVE-2012-3479 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJQKJPMAAoJEBYNRVNeJnmTfa8QAMp9laqz/ihbWisZWmHk5kkQ
1afhhPxgSOauIPnuc2myWIP53lu8buJOgXOCo1Tl6fvfjMGu8zWJ3gr3xnqRyYjr
m1EbiUZtrqdlyukvkReU08CVWmW8lXkn6W3znc3S6JQNq+eRxgBXMvcbAtNnJzKA
ri6ApmMIqKZkbV9p8hqyHeNcdCdfi4nrjBr4vff6UX4SM1hqe05P6DOa8FCoRDIj
Wt81d3zUenGwuVyFaRknuqw0dwQ6svwjCpcpsZnEiwjPZG+8IDlo8aCrvuThKh+x
DTcD3Lt8Vr7+6QhAf7a20PDwJvM1KcinkHDQ1qE6ZvmxcdTJmoY0R+2wZqdnX2UZ
f7mlqS8GPxH4V173ypz98eM0IhI/E4ZXSlTHg0vThq33QJ9NNjQ0OuDJhM5fuikF
vY/s2n2TymrEAIjP6CMwZjZfSe56SzcJadR3Pq56H7RD+zSJYJmfasWbK56acjHA
qE5xxvunO7UZPMAsYqUMGIqVCv5EsiDmmoFF/Xtlk98/at8AWfKNt27IGqPU+io3
ShpGjDcptN8yitOPaPcEaAim6ndfObL4LlLozNv85M71oJ7tcDGiVBPaPRIjB0AJ
bXpunXMcEigQlazVy/T4CIv7r2P2ZR64at16t0LKiR4XiTL016rjUkhSuHdPSdU3
FS+YTLukIBYRDIFbbJss
=jFS2
-----END PGP SIGNATURE-----

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.