From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham autolearn_force=no version=3.4.4 Received: from zero.zsh.org (zero.zsh.org [IPv6:2a02:898:31:0:48:4558:7a:7368]) by inbox.vuxu.org (Postfix) with ESMTP id 1CE0026525 for ; Fri, 10 May 2024 10:26:57 +0200 (CEST) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=zsh.org; s=rsa-20210803; t=1715329617; b=dzn1rlJcNGViLR8/cGnOhbHO1aslonBCM8czOBbaxtjsj2tSXt6h3KvNbspls3zsErAfqgmSjy fGamTiG35gXtGU/VMddKSg2Q6g/I0lC9+56zB6EtBBIqK5OrncZ/rQ1s2akK9nUAJ+5Ohxp7Dv nNWB62gQcp+5oPqIHAOpaKPDjuIkmM3ayzc+oO5QXK7cQs6pZyKBjer0rs3q6unOvWG8sENk0b AwH1razIRNf05vyT7uzYt9yIne8iT8FQm5vSlEC61UOLe5d8nDy5bQ29kVwuFBoERUOZMBjFnA nSzHNrmp1l+UoC/04CKa+JYiBi9xAnLFE8z84ZTpcbf8Ng==; ARC-Authentication-Results: i=1; zsh.org; iprev=pass (mail-ot1-f43.google.com) smtp.remote-ip=209.85.210.43; dkim=pass header.d=gmail.com header.s=20230601 header.a=rsa-sha256; dmarc=pass header.from=gmail.com; arc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed; d=zsh.org; s=rsa-20210803; t=1715329617; bh=Lm5KXzMyc93k2oOLmKYOLhI6KXIzcgxPT1ZV/EtilhE=; h=List-Archive:List-Owner:List-Post:List-Unsubscribe:List-Subscribe:List-Help: List-Id:Sender:Content-Type:To:Subject:Message-ID:Date:From:MIME-Version: DKIM-Signature:DKIM-Signature; b=DzYgjZuQzv2u5ZDg9ElaK2bXk5EL+unZkTZbXqLuBgleW7vOjVCVDXr9m+cd9ezC2RcpySQ6Gd vDKog4gxtino17g87F+PS9xioT+U1PUtb4U068qyr3ZtqzPfGxthIakyfF4yU4DEyVfa7z0s52 4NEUYdlSPPoKpeQ/cEX+prQClyCgxFMrEoVp1jDr0PFXPUXOatQkrTjnFOMBSH7Enu1phrf+5J McQQH8sFebL/usbTP7842cLS682HPAtjpboS3fMRv27g7bKlodPueRfI5Khsdi+F4Ejoq2LCEd ets2J84h6TgFgMAKHlQzmZYhUzu/avIfKIi+XRvgJ027dQ==; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=zsh.org; s=rsa-20210803; h=List-Archive:List-Owner:List-Post:List-Unsubscribe: List-Subscribe:List-Help:List-Id:Sender:Content-Type:To:Subject:Message-ID: Date:From:MIME-Version:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References; bh=Lm5KXzMyc93k2oOLmKYOLhI6KXIzcgxPT1ZV/EtilhE=; b=CGQgdlIfoIhHJcuCL7YNLBekMO CMsXYsJxBWMYEbeiiWNwn9sl9qOOL+VilR6Rmcx1aPKYXXUXIDxqnDLsqk0DzbuxaZCSqYJj7tRv9 ePDAV/NMVVm1rREg1FKl01R5AJ5toEHmNt2VlO1G0gsplA+Wdw6ryGHmzJgZYJzGijR/6VINEweTP itEuDEzASgKpG/Y0q7yqeaSwLAk2uejIpGMq5LteW0qF8xMelf0rUs4U/UA5KQcLw5459R7KBKEFs cs7GZNgqKz/KXrzTFADPXEM0h8MS/WblEZvWFWyH3Em9mxmH4SjpbXmEyJo5mbaPIbDqxu2MWJDTM iG050kKA==; Received: by zero.zsh.org with local id 1s5Lai-00021C-4A; Fri, 10 May 2024 08:26:56 +0000 Authentication-Results: zsh.org; iprev=pass (mail-ot1-f43.google.com) smtp.remote-ip=209.85.210.43; dkim=pass header.d=gmail.com header.s=20230601 header.a=rsa-sha256; dmarc=pass header.from=gmail.com; arc=none Received: from mail-ot1-f43.google.com ([209.85.210.43]:42302) by zero.zsh.org with esmtps (TLS1.3:TLS_AES_128_GCM_SHA256:128) id 1s5LaP-0001iu-PJ; Fri, 10 May 2024 08:26:38 +0000 Received: by mail-ot1-f43.google.com with SMTP id 46e09a7af769-6f0e379096fso596845a34.1 for ; Fri, 10 May 2024 01:26:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1715329596; x=1715934396; darn=zsh.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=Lm5KXzMyc93k2oOLmKYOLhI6KXIzcgxPT1ZV/EtilhE=; b=GMH4sSv8wRVHPLiUnjrRsyfzRMqwpNitdtcVz0ck4At4QvdohhYfJM3Rza2b3fr+Ii bYt1GVwYAx93Y39BNe0xyLTCDt0INSXdUse9N3500Zp/ZNTZynjAeG407IxCAhOTEBh1 SLDRiS7sIvLOcHQgoNun8Wkob8GVs1/+v9r3PsN0SuHADyGClj6KR+ClpI7Lcg7vOQeI hCImxBpB3R8zqZ74B2ohHBcufYGxp+8QcZ+I6nGs3QXALPgHeHAF7enssi5JuXGSfs05 UKO62/FbFuQjP3MQAg9978FOCuEtZhZIcJx4EF0R5x1fWuMis1rl+uTHp0OGtDnOtHC6 AEtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715329596; x=1715934396; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=Lm5KXzMyc93k2oOLmKYOLhI6KXIzcgxPT1ZV/EtilhE=; b=Hluay6/c3qNgzKSTNImCLAp1IAMOD0G5nL4rAm5OQgaxoCwCL8S8GyfnhY5xB2Vu7+ HUTgfVx+n9JPKrHDxMTED5FW1vZL8XuzMCB98XwmxFkarqrX+/uSBQ3ghhKCuxGU82/V WI+tZbzVD6kBn1h4/SQ4LVDzOgy5Ph0EljQGvNHkVeFt8KkJsOdq6e2bBt37945iQKxe wuJCwr/slTTMkfpMySbMxpV4758bMtEJQ/sWL6kNItvmQIt3dEpml37plvbCzoUx10xq UrN41KvLKfSRaAz/q9c3U04FGOUH4lVTcPKQTKAh5Jb3Wzt987o1LA+2PK9OhZtDgaab PrtA== X-Gm-Message-State: AOJu0Yy+aFS/6T/6qmTVuqvwHrfRjVK4jZMj28Utq+lydNjxmckN6cef LnM4d7uC1e4iA8tnb8wsXFJ1I0xm/EK8gzybwLuhG9XXFyyupHr+7sIVIQrWAXxqXzFvH+TfgGD 0odWn1cs48LC7NvHvwna8Z52zbBUVonIH3SI0IuOn X-Google-Smtp-Source: AGHT+IHjksyy0yDldomz3YZX0xt6xgmYRCC0Qyn5UFI69qEUhZITw3/x6h4GRu8iAIfoupDgrxREgYM47fT0vf07kxk= X-Received: by 2002:a05:6830:3a90:b0:6f0:49fd:8541 with SMTP id 46e09a7af769-6f0dbf379ecmr2182259a34.4.1715329595775; Fri, 10 May 2024 01:26:35 -0700 (PDT) MIME-Version: 1.0 From: Hamidreza <0xxparrot1@gmail.com> Date: Fri, 10 May 2024 11:56:25 +0330 Message-ID: Subject: User after Free in zftp module To: zsh-workers@zsh.org Content-Type: multipart/alternative; boundary="0000000000003aa27c0618154b10" X-Seq: 52921 Archived-At: X-Loop: zsh-workers@zsh.org Errors-To: zsh-workers-owner@zsh.org Precedence: list Precedence: bulk Sender: zsh-workers-request@zsh.org X-no-archive: yes List-Id: List-Help: , List-Subscribe: , List-Unsubscribe: , List-Post: List-Owner: List-Archive: --0000000000003aa27c0618154b10 Content-Type: text/plain; charset="UTF-8" Hello, There is a security vulnerablity in zftp module. At ` https://github.com/zsh-users/zsh/blob/acdcf9d8542a4461c0fceb98fdfef7380a128f78/Src/Modules/zftp.c#L3149`, `zfsessions` is begin freed but the variable is not set to NULL afterwards which leads to a "Use after Free" bug. Regards, --0000000000003aa27c0618154b10 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello,

There is a security vulner= ablity in zftp module.
At `ht= tps://github.com/zsh-users/zsh/blob/acdcf9d8542a4461c0fceb98fdfef7380a128f7= 8/Src/Modules/zftp.c#L3149`, `zfsessions` is begin freed but the variab= le is not set to NULL afterwards which leads to a "Use after Free"= ; bug.=C2=A0

Regards,
--0000000000003aa27c0618154b10--