Bug 945164 – <app-editors/emacs-{26.3-r22, 27.2-r20, 28.2-r16, 29.4-r2}: Arbitrary code execution

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description Sam James 2024-11-27 23:59:18 UTC]

Writeup is at https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html

emacs-devel thread: https://lists.gnu.org/archive/html/emacs-devel/2024-11/msg00749.html

[Comment 1 Ulrich Müller 2024-11-28 09:02:16 UTC]

We don't enable flymake by default.

[Comment 2 Sam James 2024-12-23 09:05:52 UTC]

https://lwn.net/SubscriberLink/1002046/fffdfa49bcc60f1d/

[Comment 3 Sam James 2025-02-23 17:56:43 UTC]

Fixing typo in CVE.

[Comment 4 Sam James 2025-02-23 18:01:37 UTC]

The emacs-30.1 announcement mentions a fix for this (https://lists.gnu.org/archive/html/emacs-devel/2025-02/msg00997.html).

[Comment 5 Ulrich Müller 2025-02-24 09:20:53 UTC]

Created attachment 919797 [details, diff]
Patch for Emacs 29.4

Please review.

[Comment 6 Ulrich Müller 2025-02-24 09:21:47 UTC]

Created attachment 919798 [details, diff]
Patch for Emacs 28.2

Please review.

[Comment 7 Ulrich Müller 2025-02-24 09:22:16 UTC]

Created attachment 919799 [details, diff]
Patch for Emacs 27.2

Please review.

[Comment 8 Ulrich Müller 2025-02-24 09:22:51 UTC]

Created attachment 919800 [details, diff]
Patch for Emacs 26.3

Please review.

[Comment 9 Larry the Git Cow 2025-02-25 18:55:06 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/proj/emacs-patches.git/commit/?id=f24370de4de0a37304958ec1569d5c50c1745b7f

commit f24370de4de0a37304958ec1569d5c50c1745b7f
Author:     Ulrich Müller <[e-mail]>
AuthorDate: 2025-02-24 09:17:41 +0000
Commit:     Ulrich Müller <[e-mail]>
CommitDate: 2025-02-25 18:49:14 +0000

    Fix unsafe macro-expansion vulnerability
    
    Bug: https://bugs.gentoo.org/945164
    Signed-off-by: Ulrich Müller <[e-mail]>

 emacs/26.3/15_all_trusted-content.patch | 262 ++++++++++++++++++++++++++++++++
 emacs/27.2/16_all_trusted-content.patch | 262 ++++++++++++++++++++++++++++++++
 emacs/28.2/19_all_trusted-content.patch | 262 ++++++++++++++++++++++++++++++++
 emacs/29.4/07_all_trusted-content.patch | 261 +++++++++++++++++++++++++++++++
 4 files changed, 1047 insertions(+)

[Comment 10 Larry the Git Cow 2025-02-25 18:58:23 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=47f394193647eb7638f6740d4e5e47b9d6bff954

commit 47f394193647eb7638f6740d4e5e47b9d6bff954
Author:     Ulrich Müller <[e-mail]>
AuthorDate: 2025-02-25 18:52:41 +0000
Commit:     Ulrich Müller <[e-mail]>
CommitDate: 2025-02-25 18:58:15 +0000

    app-editors/emacs: Fix flymake and man vulnerabilities
    
    Bug: https://bugs.gentoo.org/945164
    Bug: https://bugs.gentoo.org/950192
    Signed-off-by: Ulrich Müller <[e-mail]>

 app-editors/emacs/Manifest              |   4 +
 app-editors/emacs/emacs-26.3-r22.ebuild | 377 +++++++++++++++++++
 app-editors/emacs/emacs-27.2-r20.ebuild | 447 ++++++++++++++++++++++
 app-editors/emacs/emacs-28.2-r16.ebuild | 558 +++++++++++++++++++++++++++
 app-editors/emacs/emacs-29.4-r2.ebuild  | 648 ++++++++++++++++++++++++++++++++
 5 files changed, 2034 insertions(+)