FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- posix_spawnp(3) buffer overflow

Affected packages
11.4 <= FreeBSD < 11.4_1

Details

VuXML ID f8b46415-c264-11ea-8659-901b0ef719ab
Discovery 2020-07-09
Entry 2020-07-10

Problem Description:

posix_spawnp spawns a new thread with a limited stack allocated on the heap before delegating to execvp for the final execution within that thread.

execvp would previously make unbounded allocations on the stack, directly proportional to the length of the user-controlled PATH environment variable.

Impact:

Long values in the user-controlled PATH environment variable cause posix_spawnp to write beyond the end of stack that was allocated, ultimately overflowing the heap-allocated stack with a direct copy of the value stored in PATH.

References

CVE Name CVE-2020-7458
FreeBSD Advisory SA-20:18.posix_spawnp