[DragonFlyBSD - Bug #3420] Command injection in netif

[liweitianux]

Issue #3420 has been updated by liweitianux.


Add one more example:

<pre>
root at qemu:~ # ifconfig tap create
tap0

root at qemu:~ # ifconfig tap0 name "tap0;id;"
tap0;id;

root at qemu:~ # ifconfig "tap0;id;"
tap0;id;: flags=808802<BROADCAST,SIMPLEX,MULTICAST,PROXY> metric 0 mtu 1500
        ether 00:bd:a6:7e:05:00
        groups: tap
        media: Ethernet autoselect
        status: no carrier

root at qemu:~ # service netif start "tap0;id;"
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)

root at qemu:~ # service netif stop "tap0;id;"
Stopping network:ifconfig: interface tap0 does not exist
.
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest), 90(nvmm)
</pre>


----------------------------------------
Bug #3420: Command injection in netif
http://bugs.dragonflybsd.org/issues/3420#change-14694

* Author: namiarj
* Status: New
* Priority: Normal
* Category: Userland
* Target version: 6.6
* Start date: 2026-09-10
----------------------------------------
The netif script is susceptible to command injection and glob expansion. The root cause seems to be the use of evals in /etc/network.subr. Reproduction:

@service netif start “;id;”@

The command injection and glob bug can be combined:
@touch “/tmp/;id;”
service netif start /tmp/*@

It also affects rc.conf this makes command injection persistent across boots and a command like reboot can make the system stuck in loops:
@sysrc ifconfig_wlan0=“;reboot;”@

For context:
https://lists.freebsd.org/archives/freebsd-bugs/2026-August/035962.html



-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account