Security flaw in GNU Emacs file-local variables

[Chong Yidong <cyd () gnu org>]

Paul Ling has found a security flaw in the file-local variables code in
GNU Emacs.  We are preparing a new Emacs release to address this flaw,
and would like to request a CVE.

When the Emacs user option `enable-local-variables' is set to `:safe'
(the default value is t), Emacs should automatically refuse to evaluate
`eval' forms in file-local variable sections.  Due to the bug, Emacs
instead automatically evaluates such `eval' forms.  Thus, if the user
changes the value of `enable-local-variables' to `:safe', visiting a
malicious file can cause automatic execution of arbitrary Emacs Lisp
code with the permissions of the user.

The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1.

Attached are patches to fix this bug for Emacs 23.4 and Emacs 24.1,
written by Glenn Morris.  (The 23.4 patch should apply to the rest of
the Emacs 23.x series.)

Bug tracker ref: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155

*** emacs-23.4/lisp/files.el~   2012-08-13 10:50:42.340171173 +0800
--- emacs-23.4/lisp/files.el    2012-08-13 10:51:12.528172450 +0800
***************
*** 2986,2996 ****
              ;; Obey `enable-local-eval'.
              ((eq var 'eval)
               (when enable-local-eval
!                (push elt all-vars)
!                (or (eq enable-local-eval t)
!                    (hack-one-local-variable-eval-safep (eval (quote val)))
!                    (safe-local-variable-p var val)
!                    (push elt unsafe-vars))))
              ;; Ignore duplicates (except `mode') in the present list.
              ((and (assq var all-vars) (not (eq var 'mode))) nil)
              ;; Accept known-safe variables.
--- 2986,3001 ----
              ;; Obey `enable-local-eval'.
              ((eq var 'eval)
               (when enable-local-eval
!                (let ((safe (or (hack-one-local-variable-eval-safep
!                                 (eval (quote val)))
!                                ;; In case previously marked safe (bug#5636).
!                                (safe-local-variable-p var val))))
!                  ;; If not safe and e-l-v = :safe, ignore totally.
!                  (when (or safe (not (eq enable-local-variables :safe)))
!                    (push elt all-vars)
!                    (or (eq enable-local-eval t)
!                        safe
!                        (push elt unsafe-vars))))))
              ;; Ignore duplicates (except `mode') in the present list.
              ((and (assq var all-vars) (not (eq var 'mode))) nil)
              ;; Accept known-safe variables.

Diff finished.  Mon Aug 13 10:53:45 2012

*** emacs-24.1/lisp/files.el~   2012-08-13 10:54:50.256181658 +0800
--- emacs-24.1/lisp/files.el    2012-08-13 10:54:58.076181990 +0800
***************
*** 3107,3117 ****
              ;; Obey `enable-local-eval'.
              ((eq var 'eval)
               (when enable-local-eval
!                (push elt all-vars)
!                (or (eq enable-local-eval t)
!                    (hack-one-local-variable-eval-safep (eval (quote val)))
!                    (safe-local-variable-p var val)
!                    (push elt unsafe-vars))))
              ;; Ignore duplicates (except `mode') in the present list.
              ((and (assq var all-vars) (not (eq var 'mode))) nil)
              ;; Accept known-safe variables.
--- 3107,3122 ----
              ;; Obey `enable-local-eval'.
              ((eq var 'eval)
               (when enable-local-eval
!                (let ((safe (or (hack-one-local-variable-eval-safep
!                                 (eval (quote val)))
!                                ;; In case previously marked safe (bug#5636).
!                                (safe-local-variable-p var val))))
!                  ;; If not safe and e-l-v = :safe, ignore totally.
!                  (when (or safe (not (eq enable-local-variables :safe)))
!                    (push elt all-vars)
!                    (or (eq enable-local-eval t)
!                        safe
!                        (push elt unsafe-vars))))))
              ;; Ignore duplicates (except `mode') in the present list.
              ((and (assq var all-vars) (not (eq var 'mode))) nil)
              ;; Accept known-safe variables.

Diff finished.  Mon Aug 13 10:55:03 2012