mirror of
https://git.yoctoproject.org/poky
synced 2026-10-23 07:28:17 +00:00
Hitendra Prajapati
ba66043d77
Pick patch from [1], [2] & [3] also mentioned at NVD report in [4,5 & 6] [1] https://github.com/vim/vim/commit/65c1a143c331c886dc28888dd632708f953b4eb3 [2] https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb [3] https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0 [4] https://nvd.nist.gov/vuln/detail/CVE-2026-28421 [5] https://nvd.nist.gov/vuln/detail/CVE-2026-41411 [6] https://nvd.nist.gov/vuln/detail/CVE-2026-44656 More info : CVE-2026-28421 - Validate block tree indices and readfile() line bounds. CVE-2026-41411 - Disallow backticks before attempting to expand filenames. CVE-2026-44656 - Prevent shell execution from 'path' backticks via modelines. (From OE-Core rev: 3fe9e5132aab67f1ee3139c88a89d5c6c94313c1) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
131 lines
4.3 KiB
Diff
131 lines
4.3 KiB
Diff
From 190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0 Mon Sep 17 00:00:00 2001
|
|
From: Christian Brabandt <cb@256bit.org>
|
|
Date: Sun, 3 May 2026 16:10:03 +0000
|
|
Subject: [PATCH] patch 9.2.0435: [security]: backticks in 'path' may cause
|
|
shell execution on completion
|
|
|
|
Problem: [security]: Backticks enclosed shell commands in the 'path'
|
|
option value are executed during completion (q1uf3ng).
|
|
Solution: Skip path entries containing backticks, add P_SECURE to 'path'
|
|
option, so that it cannot be set from a modeline (for symmetry with
|
|
the 'cdpath' option)
|
|
|
|
Github Advisory:
|
|
https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg
|
|
|
|
Supported by AI.
|
|
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
|
|
CVE: CVE-2026-44656
|
|
Upstream-Status: Backport [https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
runtime/doc/options.txt | 5 ++++-
|
|
src/findfile.c | 4 ++++
|
|
src/optiondefs.h | 2 +-
|
|
src/testdir/test_find_complete.vim | 17 +++++++++++++++++
|
|
src/testdir/test_modeline.vim | 14 ++++++++++++++
|
|
5 files changed, 40 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/runtime/doc/options.txt b/runtime/doc/options.txt
|
|
index 8dba6f4..d06411f 100644
|
|
--- a/runtime/doc/options.txt
|
|
+++ b/runtime/doc/options.txt
|
|
@@ -1,4 +1,4 @@
|
|
-*options.txt* For Vim version 9.1. Last change: 2025 Aug 23
|
|
+*options.txt* For Vim version 9.2. Last change: 2026 May 03
|
|
|
|
|
|
VIM REFERENCE MANUAL by Bram Moolenaar
|
|
@@ -6615,6 +6615,9 @@ A jump table for the options with a short description can be found at |Q_op|.
|
|
< Replace the ';' with a ':' or whatever separator is used. Note that
|
|
this doesn't work when $INCL contains a comma or white space.
|
|
|
|
+ This option cannot be set from a |modeline| or in the |sandbox|, for
|
|
+ security reasons.
|
|
+
|
|
*'perldll'*
|
|
'perldll' string (default depends on the build)
|
|
global
|
|
diff --git a/src/findfile.c b/src/findfile.c
|
|
index 008338c..f73a66b 100644
|
|
--- a/src/findfile.c
|
|
+++ b/src/findfile.c
|
|
@@ -2412,6 +2412,10 @@ expand_path_option(
|
|
{
|
|
buflen = copy_option_part(&path_option, buf, MAXPATHL, " ,");
|
|
|
|
+ // do not expand backticks, could have been set via a modeline
|
|
+ if (vim_strchr(buf, '`') != NULL)
|
|
+ continue;
|
|
+
|
|
if (buf[0] == '.' && (buf[1] == NUL || vim_ispathsep(buf[1])))
|
|
{
|
|
size_t plen;
|
|
diff --git a/src/optiondefs.h b/src/optiondefs.h
|
|
index bd02d04..72d3f36 100644
|
|
--- a/src/optiondefs.h
|
|
+++ b/src/optiondefs.h
|
|
@@ -1957,7 +1957,7 @@ static struct vimoption options[] =
|
|
(char_u *)&p_pm, PV_NONE,
|
|
did_set_backupext_or_patchmode, NULL,
|
|
{(char_u *)"", (char_u *)0L} SCTX_INIT},
|
|
- {"path", "pa", P_STRING|P_EXPAND|P_VI_DEF|P_COMMA|P_NODUP,
|
|
+ {"path", "pa", P_STRING|P_EXPAND|P_VI_DEF|P_SECURE|P_COMMA|P_NODUP,
|
|
(char_u *)&p_path, PV_PATH, NULL, NULL,
|
|
{
|
|
#if defined(AMIGA) || defined(MSWIN)
|
|
diff --git a/src/testdir/test_find_complete.vim b/src/testdir/test_find_complete.vim
|
|
index 079fb78..8b8b71c 100644
|
|
--- a/src/testdir/test_find_complete.vim
|
|
+++ b/src/testdir/test_find_complete.vim
|
|
@@ -161,4 +161,21 @@ func Test_find_complete()
|
|
set path&
|
|
endfunc
|
|
|
|
+" Verify that backticks in 'path' are not executed
|
|
+func Test_find_completion_backtick_in_path()
|
|
+ CheckUnix
|
|
+ CheckExecutable id
|
|
+
|
|
+ new Xpoc.c
|
|
+ setl path+=`id>Xrce_marker`
|
|
+ " Triggering completion must not execute the backtick command.
|
|
+ call getcompletion('', 'file_in_path')
|
|
+ call assert_false(filereadable('Xrce_marker'))
|
|
+ call feedkeys(":find \t\n", "xt")
|
|
+ call assert_false(filereadable('Xrce_marker'))
|
|
+
|
|
+ bwipe!
|
|
+ call delete('Xrce_marker')
|
|
+endfunc
|
|
+
|
|
" vim: shiftwidth=2 sts=2 expandtab
|
|
diff --git a/src/testdir/test_modeline.vim b/src/testdir/test_modeline.vim
|
|
index c00032b..fc11cc6 100644
|
|
--- a/src/testdir/test_modeline.vim
|
|
+++ b/src/testdir/test_modeline.vim
|
|
@@ -386,4 +386,18 @@ func Test_modeline_forbidden()
|
|
bw!
|
|
endfunc
|
|
|
|
+" Verify that backticks in 'path' set from a modeline are not executed
|
|
+func Test_path_modeline()
|
|
+ let lines =<< trim END
|
|
+ // vim: set path+=foobar :
|
|
+ END
|
|
+ call writefile(lines, 'Xpoc.c', 'D')
|
|
+
|
|
+ set nomodelinestrict modeline
|
|
+ call assert_fails('split Xpoc.c', 'E520:')
|
|
+
|
|
+ bwipe!
|
|
+ set modelinestrict& modeline&
|
|
+endfunc
|
|
+
|
|
" vim: shiftwidth=2 sts=2 expandtab
|
|
--
|
|
2.34.1
|
|
|