Repository navigation
syscall, os/exec: unsanitized NUL in environment variables #56284
Description
On Windows, syscall.StartProcess and os/exec.Cmd did not properly check for invalid environment variable values. A malicious environment variable value could exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" set the variables "A=B" and "C=D".
Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.
This is CVE-2022-41716 and Go issue https://go.dev/issue/56284.
Activity
heschi commentedon Oct 19, 2022
This issue is currently not marked as security or release-blocking. Should it block the next minor release?
heschi commentedon Oct 19, 2022
cc @golang/security @golang/release
neild commentedon Oct 19, 2022
@gopherbot please open backport issues
(Sorry, I keep getting the process on this wrong. This issue is for the fix, backport issues for upcoming minor releases.)
gopherbot commentedon Oct 19, 2022
Backport issue(s) opened: #56327 (for 1.18), #56328 (for 1.19).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Nov 1, 2022
Change https://go.dev/cl/446915 mentions this issue:
[release-branch.go1.18] syscall, os/exec: reject environment variables containing NULs21 remaining items
gopherbot commentedon Nov 4, 2022
Change https://go.dev/cl/447799 mentions this issue:
[release-branch.go1.19] os/exec: allow NUL in environment variables on Plan 9[release-branch.go1.18] os/exec: allow NUL in environment variables o…
[release-branch.go1.19] os/exec: allow NUL in environment variables o…
[release-branch.go1.19] syscall, os/exec: reject environment variable…
[release-branch.go1.19] os/exec: allow NUL in environment variables o…
syscall, os/exec: reject environment variables containing NULs