Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 221197 (CVE-2008-2142) - app-editors/emacs <=21.4-r16 fast-lock-mode arbitrary lisp code execution (CVE-2008-2142)
Summary: app-editors/emacs <=21.4-r16 fast-lock-mode arbitrary lisp code execution (CV...
Status: RESOLVED FIXED
Alias: CVE-2008-2142
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High normal (vote)
Assignee: Gentoo Security
URL: http://thread.gmane.org/gmane.emacs.d...
Whiteboard: B2 [glsa+]
Keywords:
Depends on:
Blocks: 221281
  Show dependency tree
 
Reported: 2008-05-10 10:23 UTC by Christian Faulhammer (RETIRED)
Modified: 2009-02-23 22:22 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Patch for app-xemacs/edit-utils-2.37 (edit-utils-2.37-fast-lock.patch,2.10 KB, patch)
2008-06-04 07:02 UTC, Ulrich Müller
no flags Details | Diff
edit-utils-2.37-r1.ebuild (edit-utils-2.37-r1.ebuild,987 bytes, text/plain)
2008-06-04 07:05 UTC, Ulrich Müller
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Christian Faulhammer (RETIRED) gentoo-dev 2008-05-10 10:23:15 UTC
Morten Welinder reports:

By shipping a .flc accompanying an source file (.c for example) and setting font-lock-support-mode to fast-lock-mode in the source file through local variables, any Lisp code from .flc is executed without warning.  This happens in the scope of the user, so no privilege escalation, but no user interaction needed apart from opening the file.
 This only applies to Emacs 21 which is still supported by Gentoo's Emacs team and has a stable version.  Emacs 22 and 23 want a confirmation from the user, while Emacs 18 has no font-locking support at all.

XEmacs seems to be affected, too.  ulm already prepares a patch from what I heard.
Comment 1 Ulrich Müller gentoo-dev 2008-05-10 10:36:38 UTC
> ulm already prepares a patch from what I heard.

Let's first wait if upstream comes up with a solution.
Comment 2 Hans de Graaff gentoo-dev 2008-05-10 10:43:30 UTC
For XEmacs the bug report is here: http://tracker.xemacs.org/XEmacs/its/issue378
Comment 3 Christian Faulhammer (RETIRED) gentoo-dev 2008-05-12 19:31:21 UTC
Patch in http://article.gmane.org/gmane.emacs.devel/97038 for GNU Emacs, will apply tomorrow.  Should apply to XEmacs as well.
Comment 4 Ulrich Müller gentoo-dev 2008-05-12 20:19:54 UTC
> Patch in http://article.gmane.org/gmane.emacs.devel/97038 for GNU Emacs

This fix is not correct.
Comment 5 Ulrich Müller gentoo-dev 2008-05-13 00:11:57 UTC
From the reply of GNU Emacs upstream I conclude that they consider Emacs 22 only (which is not really affected in the first place).

So here is a patch that will fix the problem for both Emacs 21 and 22:
<http://sources.gentoo.org/viewcvs.py/gentoo/src/patchsets/emacs/21.4/18_all_fast-lock.patch?rev=1.1&view=markup>

Fixed in emacs-21.4-r17. I've also applied the bugfix to emacs-22.2-r2, since it still contains the affected code, although it is not loaded by default.

Arch teams, please stabilise:
app-editors/emacs-21.4-r17
app-editors/emacs-22.2-r2
Comment 6 Ulrich Müller gentoo-dev 2008-05-13 00:29:45 UTC
> So here is a patch that will fix the problem for both Emacs 21 and 22:

To clarify, this is for Emacs 21: <http://sources.gentoo.org/viewcvs.py/gentoo/src/patchsets/emacs/21.4/18_all_fast-lock.patch?rev=1.1&view=markup>

For Emacs 22 the hunk for loaddefs.el must be omitted: <http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-editors/emacs/files/emacs-22.2-fast-lock.patch?rev=1.1&view=markup>

Sorry for the bugspam.
Comment 7 Raúl Porcel (RETIRED) gentoo-dev 2008-05-13 14:41:40 UTC
alpha/ia64/sparc stable
Comment 8 Hans de Graaff gentoo-dev 2008-05-13 18:47:56 UTC
I'm still waiting for XEmacs upstream, since the fix would have to be applied to app-xemacs/edit-utils and that is not a package we can easily patch ourselves.
Comment 9 Jeroen Roovers gentoo-dev 2008-05-13 19:16:00 UTC
Stable for HPPA.
Comment 10 Markus Rothe (RETIRED) gentoo-dev 2008-05-14 07:09:59 UTC
ppc64 stable
Comment 11 Christian Faulhammer (RETIRED) gentoo-dev 2008-05-14 15:27:00 UTC
x86 stable
Comment 12 Markus Meier gentoo-dev 2008-05-14 20:23:36 UTC
amd64 stable
Comment 13 Tobias Scherbaum (RETIRED) gentoo-dev 2008-05-16 19:59:51 UTC
ppc stable
Comment 14 Ulrich Müller gentoo-dev 2008-05-18 13:34:53 UTC
app-editors/emacs-21.4-r17 (and 22.2-r2) stable on all supported arches.
Comment 15 Ulrich Müller gentoo-dev 2008-06-04 07:02:35 UTC
Created attachment 155467 [details, diff]
Patch for app-xemacs/edit-utils-2.37

Three weeks since this is fixed for GNU Emacs, so we are way behind the time scale for B2. The bug tracker of XEmacs upstream is still unavailable (why?), so I'm attaching a patch for app-xemacs/edit-utils-2.37 here.

The changed files must be byte compiled, for example by doing:
        ${XEMACS_BATCH_CLEAN} -f batch-byte-compile \
                fast-lock.el auto-autoloads.el || die "batch-byte-compile failed

However, I don't know what is the recommended method for doing this within the framework of xemacs-packages.eclass. That "unpack" is only called in src_install doesn't really ease this task.
Comment 16 Ulrich Müller gentoo-dev 2008-06-04 07:05:54 UTC
Created attachment 155469 [details]
edit-utils-2.37-r1.ebuild

Ad-hoc ebuild. It works, but is very clumsy, so I think there must be an easier or more elegant way.

graaff, please advise.
Comment 17 Hans de Graaff gentoo-dev 2008-06-05 05:50:32 UTC
XEmacs' bug tracker is down due to disk problems, as far as I can tell. No news on this security issue either.

If we must bring out our own edit-utils version I would prefer to build a package similar to the one from upstream, i.e. use the packages CVS to build a new package and distribute the .el and .elc files.

While your ebuild may work it may also miss some compatibility issues. For example, all upstream packages are built with xemacs 21.4 because the bytecode generated by 21.5 can't be read by 21.4 in all cases. By compiling things like this we may risk a bunch of subtle bugs...

Unfortunately my time to work on Gentoo at all right now is very very limited... maybe I will have some time to look at this in the weekend.
Comment 18 Ulrich Müller gentoo-dev 2008-06-14 20:05:09 UTC
(In reply to comment #15)
> Created an attachment (id=155467) [edit]
> Patch for app-xemacs/edit-utils-2.37

This has been accepted by XEmacs upstream: <http://cvs.xemacs.org/viewcvs.cgi/XEmacs/packages/xemacs-packages/edit-utils/ChangeLog?rev=1.232&content-type=text/vnd.viewcvs-markup>
Comment 19 Hans de Graaff gentoo-dev 2008-06-15 09:15:25 UTC
Since xemacs upstream's package manager is currently awol and none of the other devs seem to want to build a new package, I've just created a new xemacs package for edit-utils myself. Hopefully this works as expected...

app-xemacs/edit-utils-2.39 contains the patches that Ulrich linked to. I'd like to keep this in testing for at least a week to see if problems crop up, especially since I've packages things myself this time.
Comment 20 Hans de Graaff gentoo-dev 2008-06-25 05:28:31 UTC
No reported bugs on the new package, and I've been using it myself in the last week on both amd64 and x86, so I think we are ready to stabilize:

app-xemacs/edit-utils-2.39
app-xemacs/xemacs-packages-all-2007.04.27-r1

The latter is a meta-package that makes sure the new version of edit-utils is pulled in. ppc64 doesn't have this keyworded at all, so it can just be left as-is.
Comment 21 Ulrich Müller gentoo-dev 2008-06-25 09:20:56 UTC
Adding architecture teams to CC.

Target keywords:
app-xemacs/edit-utils-2.39: alpha amd64 ppc ppc64 sparc x86
app-xemacs/xemacs-packages-all-2007.04.27-r1: alpha amd64 ppc sparc x86

And, as a reminder:
app-editors/emacs-21.4-r17: arm s390 sh
app-editors/emacs-22.2-r2: arm s390 sh
Comment 22 Christian Faulhammer (RETIRED) gentoo-dev 2008-06-25 13:07:16 UTC
x86 stable
Comment 23 Markus Rothe (RETIRED) gentoo-dev 2008-06-25 17:15:01 UTC
ppc64 stable
Comment 24 Raúl Porcel (RETIRED) gentoo-dev 2008-06-26 12:00:30 UTC
alpha/sparc stable
Comment 25 Santiago M. Mola (RETIRED) gentoo-dev 2008-06-26 15:57:23 UTC
amd64 stable
Comment 26 Tobias Scherbaum (RETIRED) gentoo-dev 2008-07-05 10:46:25 UTC
ppc stable
Comment 27 Chris Gianelloni (RETIRED) gentoo-dev 2008-08-01 17:49:14 UTC
2008.0 is out, so no need to keep release on the CC list.
Comment 28 Ulrich Müller gentoo-dev 2008-09-06 22:20:58 UTC
app-editors/emacs:
Vulnerable versions: <22.2-r2
Unaffected: >=22.2-r2, revision >=21.4-r17, <19

app-xemacs/edit-utils:
Vulnerable versions: <2.39
Unaffected: >=2.39
Comment 29 Ulrich Müller gentoo-dev 2008-09-26 09:34:11 UTC
Friendly reminder, after three more months. The following keywords are still missing:
app-editors/emacs-21.4-r17: arm s390 sh
Comment 30 Raúl Porcel (RETIRED) gentoo-dev 2008-12-24 10:44:59 UTC
arm/s390/sh stable
Comment 31 Christian Faulhammer (RETIRED) gentoo-dev 2009-01-29 07:54:30 UTC
Security, can we assist you in any way bringing out the GLSA?  Maybe by reviewing it.
Comment 32 Pierre-Yves Rofes (RETIRED) gentoo-dev 2009-02-23 22:22:53 UTC
GLSA 200902-06, sorry for the delay...