SV.FIU.PROCESS_VARIANTS
Exposure to privilege escalation
Some process-creation system calls provide exposure to local privilege escalation. These calls are prone to attacks that allow execution of malicious code with the privileges of the host process. The SV.FIU.PROCESS_VARIANTS checker flags the following system calls:
- CreateProcess
- CreateProcessAsUser
- CreateProcessWithLogon
- ShellExecute
- ShellExecuteEx
- WinExec
- system
- _wsystem
- _*exec*
- _*spawn*
Vulnerability and risk
If a process-creation system call doesn't contain the full path of the .exe executable before calling the process-creation API, it creates an opportunity for attack. A search path vulnerability can allow local users to gain privileges using a malicious .exe file.
Mitigation and prevention
To prevent exposure:
- Use fork, execve, and pipes to control process execution completely.
- In Win32 CreateProcess, CreateProcessAsUser, or CreateProcessWithLogonW functions, don't pass a null for the first parameter, lpApplicationName, to avoid running arbitrary command. If lpApplicationName must be null, use quotation marks around the path in the second parameter, lpCommandLine:
CreateProcess(NULL, "\"C:\Program Files\foo.exe\" -L -S", ...)
Vulnerable code example #1
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
int main(int argc, char *argv[]) {
int fd;
if ((fd = open(argv[1], 0)) == -1) {
error("can't open %s", argv[1]);
return -1;
}
if (argc == 2) {/* execute command */
if (execlp ("/bin/sh/", "sh", "-c", argv[1], (char*) 0)) {
/* some code */
} else {
error("can't execute %s", argv[1]);
}
}
}
Klocwork flags the use of function execlp in line 13. This system call provides possible exposure to local privilege escalation through a malicious .exe file.
Fixed code example #1
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
int main(int argc, char *argv[]) {
int fd;
if ((fd = open(argv[1], 0)) == -1) {
error("can't open %s", argv[1]);
return -1;
}
if (argc == 2) {/* execute command */
if (execve ("/bin/sh/", "sh", "-c", argv[1], (char*) 0)) {
/* some code */
} else {
error("can't execute %s", argv[1]);
}
}
}
In the fixed code, function execlp has been replaced by execve, which controls process execution, eliminating the possibility of privilege escalation.
Vulnerable code example #2
#include <stdlib.h>
/* Execute a program passed as a command-line argument */
int main(char *argv[])
{
system(argv[1]); /* NON-COMPLIANT */
return 0;
}
Fixed code example #2
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main(int argc, char *argv[])
{
char *newargv[] = { NULL, "hello", "world", NULL };
char *newenviron[] = { NULL };
if (argc != 2) {
fprintf(stderr, "Usage: %s <file-to-exec>\n", argv[0]);
exit(EXIT_FAILURE);
}
newargv[0] = argv[1];
execve(argv[1], newargv, newenviron); /* COMPLIANT */
perror("execve"); /* execve() only returns on error */
exit(EXIT_FAILURE);
}
External guidance
Security training
Application security training materials provided by Secure Code Warrior.