[DragonFlyBSD - Bug #3420] (New) Command injection in netif

[namiarj]

Issue #3420 has been reported by namiarj.

----------------------------------------
Bug #3420: Command injection in netif
http://bugs.dragonflybsd.org/issues/3420

* Author: namiarj
* Status: New
* Priority: Normal
* Category: Userland
* Target version: 6.6
* Start date: 2026-09-10
----------------------------------------
The netif script is susceptible to command injection and glob expansion. The root cause seems to be the use of evals in /etc/network.subr. Reproduction:

@service netif start “;id;”@

The command injection and glob bug can be combined:
@touch “/tmp/;id;”
service netif start /tmp/*@

It also affects rc.conf this makes command injection persistent across boots and a command like reboot can make the system stuck in loops:
@sysrc ifconfig_wlan0=“;reboot;”@

For context:
https://lists.freebsd.org/archives/freebsd-bugs/2026-August/035962.html



-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account