grep <2.11 is vulnerable to "Arbitrary command execution"

[Joshua Rogers]

grep <2.11 is vulnerable to command execution vulnerability, and it is not possible to patch unless you build the source directly from the git repo.

ubuntu 12.04(And everything else, I would assume) uses version 2.10 of grep. it is not possible to upgrade without downloading the src and building it yourself.

PoC:

perl -e 'print "x"x(2**31)' | grep x > /dev/null

This is the grep news form for this:

 * Noteworthy changes in release 2.11 (2012-03-02) [stable]

  ** Bug fixes

    grep no longer dumps core on lines whose lengths do not fit in 'int'.
    (e.g., lines longer than 2 GiB on a typical 64-bit host).
    Instead, grep either works as expected, or reports an error.
    An error can occur if not enough main memory is available, or if the
    GNU C library's regular expression functions cannot handle such long lines.
    [bug present since "the beginning"]

Solution: Send out a grep update with atleast 2.11 grep from http://git.sv.gnu.org/cgit/grep.git

Full PoC of actually "abusing" this vulnerablility(ls -la within grep) can be provided, if 100% needed.

[Seth Arnold (seth-arnold)]

Thanks Joshua,

Kurt Seifried has expressed an interest in a reproducer, so if you have one available, please do attach it.

[Joshua Rogers (megamansec)]

perl -e 'print "x"x(2**31)' | grep x > /dev/null

just run that
if that's what you mean by a "reproducer"

[Karma Dorje (taaroa)]

Joshua Rogers
> Full PoC of actually "abusing" this vulnerablility(ls -la within grep) can be provided, if 100% needed.
We need it (full PoC).

[Joshua Rogers (megamansec)]

After more analysis, it may not be vulnerable to command execution.
Not sure.

[Joshua Rogers (megamansec)]

Under MORE analysis, it does appear to allow command execution, but I can't get the ls -la working.
I'm a noob at asm.

[Jamie Strandboge (jdstrand)]

This was fixed in 2.11-1, so Ubuntu 12.10 and 13.04 are not affected.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. hardy has reached EOL
(End of Life) for this package and is no longer supported. As
a result, this bug against hardy is being marked "Won't Fix".
Please see https://wiki.ubuntu.com/Releases for currently
supported Ubuntu releases.

Please feel free to report any other bugs you may find.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. oneiric has reached EOL
(End of Life) for this package and is no longer supported. As
a result, this bug against oneiric is being marked "Won't Fix".
Please see https://wiki.ubuntu.com/Releases for currently
supported Ubuntu releases.

Please feel free to report any other bugs you may find.

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release