GNU Emacs up to 28.2 ctags lib-src/etags.c os command injection

Summaryinfo

A vulnerability categorized as critical has been discovered in GNU Emacs up to 28.2. This impacts an unknown function of the file lib-src/etags.c of the component ctags. Executing a manipulation can lead to os command injection. This vulnerability is tracked as CVE-2022-45939. The attack can be launched remotely. No exploit exists. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in GNU Emacs up to 28.2 (Word Processing Software). It has been declared as critical. This vulnerability affects an unknown functionality of the file lib-src/etags.c of the component ctags. The manipulation with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.

The weakness was disclosed 11/28/2022. The advisory is shared for download at git.savannah.gnu.org. This vulnerability was named CVE-2022-45939 since 11/28/2022. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

The vulnerability scanner Nessus provides a plugin with the ID 211020 (Fedora 38 : emacs (2022-cbc71cc4fe)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.savannah.gnu.org.

The vulnerability is also documented in the databases at Tenable (211020) and EUVD (EUVD-2022-48781). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Word Processing Software

Vendor

• GNU

Name

• Emacs

Version

• 28.0
• 28.1
• 28.2

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion