Junglewise Threat Intelligence

CVE-2016-7543: GNU Bash privilege escalation via SHELLOPTS and PS4 variables

CVE-2016-7543 · Severity: high · CVSS 8.4 · Published 2017-01-19

Technologies: Red Hat Enterprise Linux 7, Gnu Bash, Red Hat Enterprise Linux 6. Vendors: Red Hat, Gnu.

Executive brief

A vulnerability in the Bash command-line shell allows local users to gain full administrative (root) control over a system. By providing specially crafted environment variables, an attacker can trick certain high-privilege programs into executing unauthorized commands. This could lead to a complete system takeover and unauthorized access to all data on the machine.

Technical details

A command injection vulnerability exists in GNU Bash due to improper handling of the SHELLOPTS and PS4 environment variables. When Bash is invoked by a setuid program, it may inherit these variables from the environment; specifically, the PS4 variable can be manipulated to perform command substitution during trace output (xtrace). A local, authenticated attacker can exploit this by crafting these variables to execute arbitrary commands with the elevated privileges of the setuid binary, typically resulting in root access. The issue was addressed in Bash 4.4 by ensuring shells running as root no longer inherit PS4 from the environment.

Affected products

  • GNU Bash before 4.4
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Fedora Project Fedora 23, 24, 25

Timeline

  • 2016-09-26: disclosed: Public disclosure on oss-security mailing list
  • 2016-09-26: patched: Bash 4.4 released with fix
  • 2017-01-19: advisory: NVD publication date
  • 2017-03-21: patched: Red Hat Enterprise Linux 6 security update issued
  • 2017-08-01: patched: Red Hat Enterprise Linux 7 security update issued

References

Related threats