-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the way tracexec reconstructs and displays the command line of traced processes, specifically when dealing with environment variables. When a traced process is executed with an environment variable whose key begins with a dash (e.g., -a=b), tracexec would incorrectly place this variable in the reconstructed command line for the env utility. This could lead to the environment variable being interpreted as a command-line argument to env, causing an argument injection. This is a UI-level vulnerability, but it could lead to code execution if a user copies and executes the maliciously crafted command line from the tracexec output.
The root cause is the failure to properly sanitize or escape environment variable keys that start with a dash. The fix involves detecting such environment variables and then inserting a -- separator in the reconstructed command line before the environment variables are listed. This tells the env command to stop processing command-line options, and to treat all subsequent arguments as environment variable assignments.
The vulnerable functions identified are those involved in processing the environment variables (proc::parse_failiable_envp, proc::diff_env, ptrace::inspect::read_env) which, in their vulnerable state, did not check for the problematic keys. The vulnerability manifests in the UI and printer output, which were patched to use the information from the fixed processing functions to correctly format the command string.
proc::parse_failiable_envpsrc/proc.rs
proc::diff_envsrc/proc.rs
ptrace::inspect::read_envsrc/ptrace/inspect.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tracexec | rust | < 0.14.0 | 0.14.0 |
RustRustOngoing coverage of React2Shell