RE: eval '<$(;)' causes Segmentation Fault

[youheng.lue]

>> These still cause the current devel branch to segfault, but (at least 
>> for me, on macOS) only when invoked via argument, as OP directed.  For 
>> example, reading the scripts via stdin avoids the segfault.
Tested on commit cf694865de527e597de5a906643a74037341a431 
I reproduced within a Docker container based on the official Bash development 
image (bash:devel), using Alpine Linux 3.20 with GCC as the compiler. Detailed 
Dockerfile is at the end of the mail.

Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-musl
Compiler: gcc
Compilation CFLAGS: -g -O2
uname output: Linux 839141c7e5ba 6.8.0-40-generic #40~22.04.3-Ubuntu SMP 
PREEMPT_DYNAMIC Tue Jul 30 17:30:19 UTC 2 x86_64 Linux
Machine Type: x86_64-pc-linux-musl

Bash Version: 5.3
Patch Level: 0
Release Status: alpha

POC:
$ cat poc.sh
eval '<${;}'

> The specific case is an empty command containing only a redirection that 
> results in an expansion error read from a script or string.
I can confirm that the error is triggerted in the "execute_null_command" 
function and later containing a redirection.
Specifically the variable `INPUT_STREAM bashinput.location` is both a char 
pointer and an int.


At first it is used as a char pointer in the function "parse_and_execute"

BEFORE 
```
gdb> p bash_input.location.string
$3 = 0x7fb3dc0db3b0 "<${;}"
```
However at shell.c:1758 in the fuction unset_bash_input it gets overwritten to 
a fd:
```
bash_input.location.buffered_fd = -1;
```
which overwrites the last 4 bytes of the pointer with 0xffffffff
Backtrace for unset_bash_input:
► 0   0x5c55279555d3 unset_bash_input+35
   1   0x5c5527986ed8 make_child+952
   2   0x5c552796bb73 execute_null_command+387
   3   0x5c55279703fa execute_command_internal+9786
   4   0x5c55279703fa execute_command_internal+9786
   5   0x5c55279ce969 parse_and_execute+1513


AFTER
```
gdb> p bash_input.location.string
$14 = 0x7fb3ffffffff <error: Cannot access memory at address 0x7fb3ffffffff>
```
This leads to an OOB read, which leads to a segfault at evalstring.c:359
```c
while (*(bash_input.location.string) || parser_expanding_alias ())
```


Security:
   This might pose a security risk, since an attacker might leverage this to 
break out of a restricted shell.
   1. It might be possible for them to get lucky with ASLR and get a useful OOB 
read that doesn't crash.
   2. An attacker controls the size of `bash_input.location.string` which is 
allocated and therefore have some control where the OOB Read happens

Proposed fix:
    I suggest modifying INPUT_STREAM from a union to a struct to prevent 
    the type confusion between pointer and int that leads to the OOB read. 
    This is a theoretical fix and I have not tested it yet, so further 
    validation is required to confirm its effectiveness.


####### Dockerfile ##########
FROM alpine:3.20

# https://git.savannah.gnu.org/cgit/bash.git/log/?h=devel
ENV _BASH_COMMIT cf694865de527e597de5a906643a74037341a431
# optimize asynchronous function invocations; fix for running return from trap 
while sourcing a file; restore completion function if read -e is interrupted
ENV _BASH_VERSION devel-20240815
# prefixed with "_" since "$BASH..." have meaning in Bash parlance

RUN set -eux; \
        \
        apk add --no-cache --virtual .build-deps \
                bison \
                coreutils \
                dpkg-dev dpkg \
                gcc \
                libc-dev \
                make \
                ncurses-dev \
                patch \
                tar \
        ; \
        \
        wget -O bash.tar.gz 
"https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-$_BASH_COMMIT.tar.gz";;
 \
        \
        mkdir -p /usr/src/bash; \
        tar \
                --extract \
                --file=bash.tar.gz \
                --strip-components=1 \
                --directory=/usr/src/bash \
        ; \
        rm bash.tar.gz; \
        \
        if [ -d bash-patches ]; then \
                apk add --no-cache --virtual .patch-deps patch; \
                for p in bash-patches/*; do \
                        patch \
                                --directory=/usr/src/bash \
                                --input="$(readlink -f "$p")" \
                                --strip=0 \
                        ; \
                        rm "$p"; \
                done; \
                rmdir bash-patches; \
                apk del --no-network .patch-deps; \
        fi; \
        \
# https://lists.gnu.org/archive/html/bug-bash/2023-05/msg00011.html
        { echo '#include <unistd.h>'; echo; cat /usr/src/bash/lib/sh/strscpy.c; 
} > /usr/src/bash/lib/sh/strscpy.c.new; \
        mv /usr/src/bash/lib/sh/strscpy.c.new /usr/src/bash/lib/sh/strscpy.c; \
        \
        cd /usr/src/bash; \
        gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
        ./configure \
                --build="$gnuArch" \
                --enable-readline \
                --with-curses \
# musl does not implement brk/sbrk (they simply return -ENOMEM)
#   bash: xmalloc: locale.c:81: cannot allocate 18 bytes (0 bytes allocated)
                --without-bash-malloc \
        || { \
                cat >&2 config.log; \
                false; \
        }; \
        make -j "$(nproc)"; \
        make install; \
        cd /; \
# delete a few installed bits for smaller image size
        rm -rf \
                /usr/local/share/doc/bash/*.html \
                /usr/local/share/info \
                /usr/local/share/locale \
                /usr/local/share/man \
        ; \
        \
        runDeps="$( \
                scanelf --needed --nobanner --format '%n#p' --recursive 
/usr/local \
                        | tr ',' '\n' \
                        | sort -u \
                        | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { 
next } { print "so:" $1 }' \
        )"; \
        apk add --no-network --virtual .bash-rundeps $runDeps; \
        apk del --no-network .build-deps; \
        \
        [ "$(which bash)" = '/usr/local/bin/bash' ]; \
        bash --version; \
        bash -c 'help' > /dev/null

## BELOW HERE ARE CUSTOM TOOLS USED FOR DEBUGGING
# Install 
RUN set -eux; \
        \
    apk add gdb; \
    apk add git; 

# pwndbg
# RUN set -eux; \
#    apk add nix; \
#    nix shell github:pwndbg/pwndbg --extra-experimental-features nix-command 
--extra-experimental-features flakes
 
-----------
Best regards,
Youheng Lü