GHSA-wj7f-468m-6mv8 – birdcage

Package

Manager: cargo
Name: birdcage
Vulnerable Version: >=0 <0.7.0

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: N/A pctlN/A

Details

Environment variables still accessible through /proc ### Impact Environment variables can be read from procfs unless a new process is started. ### PoC ``` use birdcage::{Birdcage, Sandbox}; use std::{env, fs}; fn main() { Birdcage::new().lock().unwrap(); assert_eq!(env::var_os("SECRET"), None); let environ = fs::read_to_string("/proc/self/environ").unwrap(); assert!(!environ.contains("SECRET"), "ENVIRON CONTAINS SECRET:\n{environ}"); } ``` ``` $ SECRET=test cargo run thread 'main' panicked at src/main.rs:10:5: ENVIRON CONTAINS SECRET: [truncated] ``` ### Possible Solutions The simplest solution would be relying on the ptrace isolation and **always** spawning a new process by changing birdcage's API to create a new command. With an additional PID namespace the guarantees could be even further reinforced.

Metadata

Created: 2023-12-01T22:46:37Z
Modified: 2023-12-01T22:46:37Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-wj7f-468m-6mv8/GHSA-wj7f-468m-6mv8.json
CWE IDs: ["CWE-200"]
Alternative ID: N/A
Finding: F017
Auto approve: 1