Merge qa-regression-testing:glibc-cve-2021-35942 into qa-regression-testing:master

[Mark Esler]

test-glibc.py: add testcase for CVE-2021-35942

Alphabetized directories with files to build.

Added PoC and testcase for CVE-2021-35942.

I tested PoC on two patched systems (Jammy and Bionic) and each gave exit code 5. An unpatched system (Xenial) gave exit code -11.

Also, all glibc tests pass on Bionic, but Jammy needs to be fixed. It errors on test_d_tag_underflow and test_crypt for DES.

[Steve Beattie (sbeattie)]

Hey Mark, this looks pretty good. I'm assuming this testcase is based on a PoC from somewhere else? Can you include a reference or origin either as a comment in the source code or else as aa README, just so that we have an attribution reference where possible?

review: Needs Fixing

[Mark Esler (eslerm)]

Thanks Steve.

An attribution was added.

[Steve Beattie (sbeattie)]

Sorry for the delayed review, I've gone ahead and merged this (noting in the commit that the CVE is unfixed in a couple of releases still).

Thanks!

review: Approve

[Steve Beattie (sbeattie)]

(Also, I fixed up the failing tests for newer releases.)

diff --git a/scripts/glibc/Makefile b/scripts/glibc/Makefile
index 47be630..76de490 100644
--- a/scripts/glibc/Makefile
+++ b/scripts/glibc/Makefile
@@ -1,5 +1,5 @@
-SUBDIRS=crypt fnmatch getaddrinfo getcwd getdents strstr strspn strtod \
-	sscanf vfprintf strcoll regex malloc
+SUBDIRS=crypt fnmatch getaddrinfo getcwd getdents malloc regex sscanf \
+	strcoll strspn strstr strtod vfprintf wordexp
 
 all:
 	set -e && for dir in $(SUBDIRS) ; do \
diff --git a/scripts/glibc/wordexp/Makefile b/scripts/glibc/wordexp/Makefile
new file mode 100644
index 0000000..927dfef
--- /dev/null
+++ b/scripts/glibc/wordexp/Makefile
@@ -0,0 +1,6 @@
+CFLAGS=-O2 -g -Wall
+
+all: cve-2021-35942
+
+clean:
+	rm -f cve-2021-35942
diff --git a/scripts/glibc/wordexp/cve-2021-35942.c b/scripts/glibc/wordexp/cve-2021-35942.c
new file mode 100644
index 0000000..750d874
--- /dev/null
+++ b/scripts/glibc/wordexp/cve-2021-35942.c
@@ -0,0 +1,10 @@
+#include <wordexp.h>
+
+/* PoC for CVE-2021-35942 created by Philippe Antoine
+ * https://sourceware.org/bugzilla/show_bug.cgi?id=28011
+ */
+int main() {
+wordexp_t p;
+int ret = wordexp("\"data:888888888888888888888888888888e},},${8888888888888##sioiondata:ap                   gi37             },},{8888888888SSSSSSSSSSSSSS88883********888888888888888888888888888888e},},{8888888888888 ##sioiondata:ap                     gi37                     TTTT05T98TTTT047798T\xff\xff\xff\xd1\xff\xff\xff\ xb1TTTTT9TT//////// /Y/ 80371588u40)2961kata:888##sioiondata>ap   )", &p, 0);
+return ret;
+}
diff --git a/scripts/test-glibc.py b/scripts/test-glibc.py
index e84c511..0c8e428 100755
--- a/scripts/test-glibc.py
+++ b/scripts/test-glibc.py
@@ -300,6 +300,17 @@ class GlibcTest(testlib.TestlibCase):
         os.chdir('getcwd')
         self.assertShellExitEquals(expected, ["./cve-2018-1000001"])
 
+    def test_wordexp_cve_2021_35942(self):
+        '''wordexp atoi overflow (CVE-2021-35942)'''
+
+        os.chdir('wordexp')
+
+        # This test segfaults when vulnerable
+        # and denies access when patched
+        expected = 5
+
+        self.assertShellExitEquals(expected, ["./cve-2021-35942"])
+
 
 if __name__ == '__main__':
     # CVE-2010-3856 test fails if we're running as root