Re: Healing the bash fork

["Stuart D. Gathman" <stuart () gathman org>]

On Tue, 30 Sep 2014, Michal Zalewski wrote:

> You're describing taint tracking, which is actually a pretty hard
> problem when you realize that data isn't an abstract, immutable
> entity, but rather something that is used as input for arithmetics,
> conditional branches, etc (is a byte set as a result of a tainted
> conditional also tainted? for far-reaching should this effect be?).
>
> But more fundamentally, in your example, what does it prove? In
> practical settings, privileged programs will routinely have data from
> lower (or at least other) privilege levels in memory, but that doesn't
> indicate a security problem. In particular, both the fixed and the
> vulnerable versions of bash will have that property when invoked via a servlet.

It doesn't "prove" anything, but I thought it could maybe narrow down the
code to audit carefully.  I figured it had already been done.