From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Stefan Kangas Newsgroups: gmane.emacs.devel Subject: Re: bug#37656: 27.0.50; Arbitrary code execution with special `mode:' Date: Wed, 16 Oct 2019 00:27:18 +0200 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="167082"; mail-complaints-to="usenet@blaine.gmane.org" Cc: 37656@debbugs.gnu.org, Emacs developers To: adam plaice Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Wed Oct 16 00:28:11 2019 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([209.51.188.17]) by blaine.gmane.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1iKVIX-000hHO-SD for ged-emacs-devel@m.gmane.org; Wed, 16 Oct 2019 00:28:09 +0200 Original-Received: from localhost ([::1]:60722 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iKVIW-0000Yj-96 for ged-emacs-devel@m.gmane.org; Tue, 15 Oct 2019 18:28:08 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:37729) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iKVHx-0000YO-31 for emacs-devel@gnu.org; Tue, 15 Oct 2019 18:27:33 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iKVHv-00086q-OS for emacs-devel@gnu.org; Tue, 15 Oct 2019 18:27:32 -0400 Original-Received: from mail-pl1-f174.google.com ([209.85.214.174]:44414) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1iKVHv-00086W-J1 for emacs-devel@gnu.org; Tue, 15 Oct 2019 18:27:31 -0400 Original-Received: by mail-pl1-f174.google.com with SMTP id q15so10246795pll.11 for ; Tue, 15 Oct 2019 15:27:31 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=RolC5f2XWEigNTpjM4aN6RKNc+MwPnZ3Hn/D0Ha0+7g=; b=aThoW40iQ55dgli0ahg4dSqadiXBorrAlEuEioHPI/jmgng1L3ey66ZEmzcrrS/Rv5 D1E/5XRHsUa2Qthuy2s9f3+T6/jLBCQIy3p5+utyoZVYlHrlUJIV2/1f+UGmml4l+vn3 9OFbCKMMMjP7a2SPDZMnM8UK3z1ogsf1+4urKMF/gQPQQ6Iccu5fT3M5qB0OhWgDeMRn ptQH3QH0u8XRO7CU9eJDMnIa3dEokWm164eKjPLrToM9yq3yQhuuuRUKxtcOetrnlMnf 7CRyUCCdMDvjtNmjAgpGWBiGSitUfec9/vHlbnl8Ul5Lwt/EzG6HoBgXfcfOg+W5NYcN 6dcw== X-Gm-Message-State: APjAAAX2UEWvR5WhkdreYXFTMqdTOpDRdPBoQkLoWuicuOpUx4nr0lba L8uhw/EOBpmdTGVMzBBPQny94QjM2eytm99JpkI= X-Google-Smtp-Source: APXvYqzp2Cet8NXsGbegtSsWWcPCvulV4brG0ZY9IigXmMuUU3D7GX9lnIrBEyq7glRefam5A+LPaq7dZRrdNHgXTSM= X-Received: by 2002:a17:902:6b88:: with SMTP id p8mr35744379plk.251.1571178450268; Tue, 15 Oct 2019 15:27:30 -0700 (PDT) In-Reply-To: X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.85.214.174 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:241071 Archived-At: adam plaice writes: > Since the bug allows an attacker to execute arbitrary code if the > victim opens a payload file, and hence opening any file from an > untrusted source becomes dangerous, it seems to be rather > serious. Thanks for raising this here. I agree that this is serious, and we should treat it accordingly. The below patch seems to fix it by disabling the feature it exploits. A workaround is to add this to your init file: (setq enable-local-variables nil) Best regards, Stefan Kangas diff --git a/lisp/files.el b/lisp/files.el index 40807617fa..550227b21a 100644 --- a/lisp/files.el +++ b/lisp/files.el @@ -3068,7 +3068,7 @@ set-auto-mode (if (save-excursion (search-forward ":" end t)) ;; Find all specifications for the `mode:' variable ;; and execute them left to right. - (while (let ((case-fold-search t)) + (when (let ((case-fold-search t)) (or (and (looking-at "mode:") (goto-char (match-end 0))) (re-search-forward "[ \t;]mode:" end t)))