GNU logs - #37864, boring messages

Message sent to bug-coreutils@HIDDEN:

Subject: bug#37864: bug: env exec bomb (no hash bang arg)
Resent-From: Michael Coleman <michael.karl.coleman@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-coreutils@HIDDEN
Resent-Date: Tue, 22 Oct 2019 04:48:02 +0000
Resent-Message-ID: <handler.37864.B.15717196767427 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 37864 <at> debbugs.gnu.org
Reply-To: Michael Coleman <michael.karl.coleman@HIDDEN>
Date: Tue, 22 Oct 2019 02:13:13 +0000
From: Michael Coleman <michael.karl.coleman@HIDDEN>
Message-ID: <17bClHZId-5_cZF9E-FZDRYXmGPkuZzfhzK4fHuB2PDuSmwYl0QJRx3G8omcoGrdYt0aP1m1zcyT2vT-aovh43kZZ5IjlQj2geVB4r59puM=@protonmail.com>
Feedback-ID: XX9hSSocx1U34xjIhJpxwcNSMDF9qc5KyHXxO3XCrntOXhtds2oDxXpapF4Nn_efTPbd2lkSYC2L7qrjRIv9aQ==:Ext:ProtonMail
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="b1_85cf60dbd0638572be671de6246784a9"
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

This is a multi-part message in MIME format.

--b1_85cf60dbd0638572be671de6246784a9
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: base64

T25lIG9mIG15IHVzZXJzIHVud2l0dGluZ2x5IHN0dW1ibGVkIHVwb24gdGhlIG1vc3QgZGVsaWdo
dGZ1bCAnZW52JyBidWcuICBJdCBzZWVtcyB0byBiZSBwcmVzZW50IGluIGEgY291cGxlIG9mIHBy
ZXR0eSByZWNlbnQgZGlzdHJpYnV0aW9ucy4KClRyeSB0aGlzOgoKLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLQojIS91c3IvYmluL2Vudgp3aGF0ZXZlcgotLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tCgpUaGlzIHJlc3VsdHMgaW4gYW4gZW5kbGVzcyAnZXhlY3ZlJyByZWN1cnNpb24gKGlm
IHRoYXQncyB0aGUgd29yZCksIHBlZ2dpbmcgdGhlIENQVS4KClRoZSBwcmVmZXJyZWQgYmVoYXZp
b3Igd291bGQgYmUgc29tZXRoaW5nIGxpa2UgYSBkaWFnbm9zdGljLCBmb2xsb3dlZCBieSBpbW1l
ZGlhdGUgZXhpdCB3aXRoIGFuIGVycm9yIHJlc3VsdC4KClJlZ2FyZHMsCk1pa2U=


--b1_85cf60dbd0638572be671de6246784a9
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: base64

PGRpdj5PbmUgb2YgbXkgdXNlcnMgdW53aXR0aW5nbHkgc3R1bWJsZWQgdXBvbiB0aGUgbW9zdCBk
ZWxpZ2h0ZnVsICdlbnYnIGJ1Zy4mbmJzcDsgSXQgc2VlbXMgdG8gYmUgcHJlc2VudCBpbiBhIGNv
dXBsZSBvZiBwcmV0dHkgcmVjZW50IGRpc3RyaWJ1dGlvbnMuPGJyPjwvZGl2PjxkaXY+PGJyPjwv
ZGl2PjxkaXY+VHJ5IHRoaXM6PGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+LS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLTwvZGl2PjxkaXY+IyEvdXNyL2Jpbi9lbnY8YnI+PC9kaXY+PGRp
dj53aGF0ZXZlcjwvZGl2PjxkaXY+LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTxicj48L2Rp
dj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRoaXMgcmVzdWx0cyBpbiBhbiBlbmRsZXNzICdleGVjdmUn
IHJlY3Vyc2lvbiAoaWYgdGhhdCdzIHRoZSB3b3JkKSwgcGVnZ2luZyB0aGUgQ1BVLjxicj48L2Rp
dj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRoZSBwcmVmZXJyZWQgYmVoYXZpb3Igd291bGQgYmUgc29t
ZXRoaW5nIGxpa2UgYSBkaWFnbm9zdGljLCBmb2xsb3dlZCBieSBpbW1lZGlhdGUgZXhpdCB3aXRo
IGFuIGVycm9yIHJlc3VsdC48L2Rpdj48ZGl2IGNsYXNzPSJwcm90b25tYWlsX3NpZ25hdHVyZV9i
bG9jayBwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jay1lbXB0eSI+PGRpdiBjbGFzcz0icHJvdG9u
bWFpbF9zaWduYXR1cmVfYmxvY2stdXNlciBwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jay1lbXB0
eSI+PGJyPjwvZGl2PjxkaXYgY2xhc3M9InByb3Rvbm1haWxfc2lnbmF0dXJlX2Jsb2NrLXByb3Rv
biBwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jay1lbXB0eSI+PGJyPjwvZGl2PjwvZGl2PjxkaXY+
PGJyPjwvZGl2PjxkaXY+UmVnYXJkcyw8YnI+PC9kaXY+PGRpdj5NaWtlPGJyPjwvZGl2Pg==



--b1_85cf60dbd0638572be671de6246784a9--

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Michael Coleman <michael.karl.coleman@HIDDEN>
Subject: bug#37864: Acknowledgement (bug: env exec bomb (no hash bang arg))
Message-ID: <handler.37864.B.15717196767427.ack <at> debbugs.gnu.org>
References: <17bClHZId-5_cZF9E-FZDRYXmGPkuZzfhzK4fHuB2PDuSmwYl0QJRx3G8omcoGrdYt0aP1m1zcyT2vT-aovh43kZZ5IjlQj2geVB4r59puM=@protonmail.com>
X-Gnu-PR-Message: ack 37864
X-Gnu-PR-Package: coreutils
Reply-To: 37864 <at> debbugs.gnu.org
Date: Tue, 22 Oct 2019 04:48:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-coreutils@HIDDEN

If you wish to submit further information on this problem, please
send it to 37864 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
37864: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D37864
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-coreutils@HIDDEN:

Subject: bug#37864: bug: env exec bomb (no hash bang arg)
Resent-From: =?UTF-8?Q?P=C3=A1draig?= Brady <P@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-coreutils@HIDDEN
Resent-Date: Tue, 22 Oct 2019 10:43:01 +0000
Resent-Message-ID: <handler.37864.B37864.157174092129115 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: Michael Coleman <michael.karl.coleman@HIDDEN>, 37864 <at> debbugs.gnu.org
References: <17bClHZId-5_cZF9E-FZDRYXmGPkuZzfhzK4fHuB2PDuSmwYl0QJRx3G8omcoGrdYt0aP1m1zcyT2vT-aovh43kZZ5IjlQj2geVB4r59puM=@protonmail.com>
From: =?UTF-8?Q?P=C3=A1draig?= Brady <P@HIDDEN>
Message-ID: <8fc4104a-3365-2dda-0751-7f3c033279b8@HIDDEN>
Date: Tue, 22 Oct 2019 11:41:56 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:70.0) Gecko/20100101
 Thunderbird/70.0
MIME-Version: 1.0
In-Reply-To: <17bClHZId-5_cZF9E-FZDRYXmGPkuZzfhzK4fHuB2PDuSmwYl0QJRx3G8omcoGrdYt0aP1m1zcyT2vT-aovh43kZZ5IjlQj2geVB4r59puM=@protonmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

On 22/10/2019 03:13, Michael Coleman via GNU coreutils Bug Reports wrote:
> One of my users unwittingly stumbled upon the most delightful 'env' bug.  It seems to be present in a couple of pretty recent distributions.
> 
> Try this:
> 
> ----------------------------
> #!/usr/bin/env
> whatever
> ----------------------------
> 
> This results in an endless 'execve' recursion (if that's the word), pegging the CPU.
> 
> The preferred behavior would be something like a diagnostic, followed by immediate exit with an error result.

Well env is being passed the script name again as an option by the kernel,
and is just executing that. There is no portable way I can see for env
to distinguish this case. I'm not sure it's such an important issue TBH.

cheers,
Pádraig

Last modified: Mon, 25 Nov 2019 12:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.