[DragonFlyBSD - Bug #3420] Command injection in netif

[sigttou]

Issue #3420 has been updated by sigttou.

File dragonfly-issue-3420-hardening.patch added

Full fix for the command injection. The main vector is not in network.subr,
it is in rc.subr.

Root cause:
run_rc_command() does:

    eval $_cmd $rc_extra_args

rc_extra_args is the raw command line, so:

    service netif start 'lo0;touch /tmp/pwned;'

becomes:

    eval netif_start lo0;touch /tmp/pwned;

This affects every rc script with a custom *_cmd, not only netif.

Repro (release tree):

    service netif start 'lo0;touch /tmp/pwned;'
    touch '/tmp/;id;'; service netif start /tmp/*

Fix:
1. rc.subr: pass extra args as positional parameters
   (eval $_cmd '"$@"'). eval no longer re-parses them. _cmd's own
   arguments (e.g. "adjkerntz -i") still work. Same for the _precmd /
   _postcmd / restart sites.
2. rc.subr: _run_rc_precmd() and _run_rc_postcmd() also eval
   $rc_extra_args. _run_rc_postcmd() is used by ports (e.g. argus3), so
   both are changed to set the positional parameters and eval only the
   fixed command string. The other _run_rc_* helpers are kept (ports
   use _run_rc_notrunning and _run_rc_doit).
3. network.subr: harden get_if_var() eval. gif_up() and ipv6 route
   setup now use get_if_var().
4. rc.d/netif: drop the eval around the interface lookup, but keep the
   expr() match, so matching behavior is unchanged. Replace the
   showstat eval pair with a plain list.

This does NOT validate or limit interface names.  Names are still
unrestricted.  get_if_var() only maps the name when building the rc.conf
variable name to look up, same idea as the old ". - / +" -> "_" mapping.

Patch attached.


----------------------------------------
Bug #3420: Command injection in netif
http://bugs.dragonflybsd.org/issues/3420#change-14712

* Author: namiarj
* Status: New
* Priority: Normal
* Category: Userland
* Target version: 6.6
* Start date: 2026-09-10
----------------------------------------
The netif script is susceptible to command injection and glob expansion. The root cause seems to be the use of evals in /etc/network.subr. Reproduction:

@service netif start “;id;”@

The command injection and glob bug can be combined:
@touch “/tmp/;id;”
service netif start /tmp/*@

It also affects rc.conf this makes command injection persistent across boots and a command like reboot can make the system stuck in loops:
@sysrc ifconfig_wlan0=“;reboot;”@

For context:
https://lists.freebsd.org/archives/freebsd-bugs/2026-August/035962.html

---Files--------------------------------
dragonfly-issue-3420-hardening.patch (4.37 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account