[DragonFlyBSD - Bug #3420] Command injection in netif

[namiarj]

Issue #3420 has been updated by namiarj.


sigttou wrote in #note-2:
> Full fix for the command injection. The main vector is not in network.subr,
> it is in rc.subr.
> 
> Root cause:
> run_rc_command() does:
> 
>     eval $_cmd $rc_extra_args
> 
> rc_extra_args is the raw command line, so:
> 
>     service netif start 'lo0;touch /tmp/pwned;'
> 
> becomes:
> 
>     eval netif_start lo0;touch /tmp/pwned;
> 
> This affects every rc script with a custom *_cmd, not only netif.
> 
> Repro (release tree):
> 
>     service netif start 'lo0;touch /tmp/pwned;'
>     touch '/tmp/;id;'; service netif start /tmp/*
> 
> Fix:
> # rc.subr: pass extra args as positional parameters
>  (eval $_cmd '"$@"'). eval no longer re-parses them. _cmd's own
>  arguments (e.g. "adjkerntz -i") still work. Same for the _precmd /
>  _postcmd / restart sites.
> # rc.subr: _run_rc_precmd() and _run_rc_postcmd() also eval
>  $rc_extra_args. _run_rc_postcmd() is used by ports (e.g. argus3), so
>  both are changed to set the positional parameters and eval only the
>  fixed command string. The other _run_rc_* helpers are kept (ports
>  use _run_rc_notrunning and _run_rc_doit).
> # network.subr: harden get_if_var() eval. gif_up() and ipv6 route
>  setup now use get_if_var().
> # rc.d/netif: drop the eval around the interface lookup, but keep the
>  expr() match, so matching behavior is unchanged. Replace the
>  showstat eval pair with a plain list.
> 
> This does NOT validate or limit interface names.  Names are still
> unrestricted.  get_if_var() only maps the name when building the rc.conf
> variable name to look up, same idea as the old ". - / +" -> "_" mapping.
> 
> Patch attached.

Thank you. I have tested a similar patch. The question is how exactly removing the evals might affect configuration parsing?

https://github.com/namiarj/DragonFlyBSD/commit/ba645ce4994923f2df049f3a662f7a85fb505297

----------------------------------------
Bug #3420: Command injection in netif
http://bugs.dragonflybsd.org/issues/3420#change-14713

* Author: namiarj
* Status: New
* Priority: Normal
* Category: Userland
* Target version: 6.6
* Start date: 2026-09-10
----------------------------------------
The netif script is susceptible to command injection and glob expansion. The root cause seems to be the use of evals in /etc/network.subr. Reproduction:

@service netif start “;id;”@

The command injection and glob bug can be combined:
@touch “/tmp/;id;”
service netif start /tmp/*@

It also affects rc.conf this makes command injection persistent across boots and a command like reboot can make the system stuck in loops:
@sysrc ifconfig_wlan0=“;reboot;”@

For context:
https://lists.freebsd.org/archives/freebsd-bugs/2026-August/035962.html

---Files--------------------------------
dragonfly-issue-3420-hardening.patch (4.37 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account