March 2023 - Wine-GitLab - list.winehq.org

[PATCH 0/1] MR2472: CommandLineToArgvW: fixed vulnerability by incorrect parsing
by Sergey G. Brester (＠sebres) March 23, 2023

March 23, 2023

### Merge request This fixes a vulnerability by incorrect parsing of command line arguments. The way how a triple quote chars (or double quote chars inside a quoted string) will be currently parsed in `CommandLineToArgvW` of wine is wrong, therefore opens an attack vector (using artificially created command line validated with different rules matching default parsing mechanism of Windows), so could be even considered as a vulnerability. ## Proposed changes `CommandLineToArgvW` will parse command line arguments correct and more similar to Windows. Here is the diff illustrating wrong behavior: ```diff ## # test is an alias for ## # python.exe -c "from sys import argv; del argv[0]; print(str(len(argv)) + ' | ' + ' | '.join(argv))" - # Wine + # Windows (and fixed variant) ## double in quoted string: > test "abc""def" ghi" xxx - 2 | abc"def ghi | xxx + 2 | abc"def | ghi xxx > test "abc"""def" ghi" xxx - 3 | abc"def | ghi" xxx + 2 | abc"def ghi | xxx ## triple in unquoted string: > test abc"""def" ghi" xxx - 2 | abc"def ghi | xxx + 2 | abc"def | ghi xxx > test abc""""def" ghi" xxx - 2 | abc"def | ghi xxx + 2 | abc"def ghi | xxx ``` As a consequence: - the arguments can be parsed incorrectly (compared to default behavior of Windows parser) in the way that parts of quoted arguments may become unquoted and vice versa, as well as swim between different args; - an attacker may create artificial command line that pass validation rules of nominal condition of Windows, but vulnerable here (inject, data steal, etc), because the arguments would deviate between validation and execution phase - special tokens like pipe `|`, ampersand `&` or redirecting tokens like `>` that normally included in quoted string (and validated as a string) could abrupt get different meaning and used for piping, redirecting etc, that beside the injection possibility opens still worse attacking vector that can even cause RCE or used to create persistent exploits. <details><summary>Here is the nominal condition how arguments will be parsed in Windows...</summary> cmd line|arg1|arg2 ---|---|--- abc" "def|abc def| abc\\" \\"def|abc"|"def "abc\\" \\"def"|abc" "def| "abc"" ""def"|abc" "def| abc"" ""def|abc|def abc""" """def|abc" "def| abc\\""" \\"""def|abc"|"def abc\\\\""" \\\\"""def|abc\\" \\"def "abc"""def" ghi"|abc"def ghi| "abc"""def" ghi * missing close qoute at end|abc"def ghi| "abc""def" ghi|abc"def|ghi "abc\\"""def" ghi|abc""def|ghi "abc\\\\"""def" ghi"|abc\\"def ghi| "abc\\\\\\"""def" ghi|abc\\""def|ghi "abc\\\\\\\\"""def" ghi"|abc\\\\"def ghi| </details> For PoC one could use any lang like tcl, python, etc, or even a self-written executable getting the argc/argv from main. The above diff and nominal condition was generated using this python script on Windows box: ```python from sys import argv; del argv[0]; print(str(len(argv)) + ' | ' + ' | '.join(argv)) ``` ## References [Related PR](https://github.com/reactos/reactos/pull/5186) with fix for ReactOS. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/2472

3 6

[PATCH v2 0/1] MR2481: wldap32: Handle null DN or null message in ldap_delete* and add tests.
by Alex Henrie (＠alexhenrie) March 23, 2023

March 23, 2023

On Windows, ldap_delete_(ext_)s returns LDAP_UNWILLING_TO_PERFORM when trying to delete an entry that cannot be deleted. On Unix, LDAP_SERVER_DOWN is returned instead. Unix also returns LDAP_SERVER_DOWN immediately from ldap_delete_ext if the entry cannot be deleted, whereas Windows queues an asynchronous operation and returns LDAP_SUCCESS. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=54702 -- v2: wldap32: Handle null DN or null message in ldap_delete* and add tests. https://gitlab.winehq.org/wine/wine/-/merge_requests/2481

3 5

[PATCH 0/11] MR2484: wineps: Initial work on writing ps data in print processor
by Piotr Caban (＠piotr) March 23, 2023

March 23, 2023

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/2484

2 12

[PATCH v4 0/3] MR1895: Fixes for NtOpenFile of read-only files with FILE_WRITE_ATTRIBUTES
by Joel Holdsworth (＠jhol) March 23, 2023

March 23, 2023

Previously, the Wine implementation of `NtOpenFile` would fail to open read-only files for `FILE_WRITE_ATTRIBUTES` access in wine-server, because it would attempt to open the file with `O_RDWR` or `O_WRONLY` access. This patch-set adds test cases to highlight the issue, and solves it by only opening the file with write access where necessary. * Wine Bug: [#50771](https://bugs.winehq.org/show_bug.cgi?id=50771) * Related Wine-Staging Patches: * [0002-server-Allow-to-open-files-without-any-permission-bi.patch](https://gi… * [0006-ntdll-tests-Added-tests-for-open-behaviour-on-readon.patch](https://gi… * [0007-server-FILE_WRITE_ATTRIBUTES-should-succeed-for-read.patch](https://gi… -- v4: server: Allow to open read-only files with FILE_WRITE_ATTRIBUTES server: Open code FILE_UNIX_{READ,WRITE}_ACCESS ntdll/tests: Added tests for attributes access on read-only files. https://gitlab.winehq.org/wine/wine/-/merge_requests/1895

2 3

Re: [PATCH v10 0/1] MR2183: winecfg: Add an option to set WinRT app dark theme.
by Alexandre Julliard (＠julliard) March 23, 2023

March 23, 2023

> How's this? > > Thanks for the review! :smiley: Actually thinking some more about this, a simple check mark may be better than a drop-down. It's not like there would be other possible options. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/2183#note_27620

1 0

[PATCH 0/3] MR2483: kernelbase: Refactor create_key() in the same way as open_key().
by Sven Baars (＠sbaars) March 23, 2023

March 23, 2023

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/2483

2 3

[PATCH v2 0/5] MR2452: imm32: Implement ImmEnumInputContext.
by Rémi Bernon March 23, 2023

March 23, 2023

-- v2: imm32: Rename InputContextData to struct imc. imm32: Use NtUserQueryInputContext to check cross-thread access. imm32: Remove unused IMM_IsCrossThreadAccess hwnd parameter. imm32: Remove unnecessary threadDefault InputContextData member. imm32: Implement ImmEnumInputContext. https://gitlab.winehq.org/wine/wine/-/merge_requests/2452

1 6

Re: [PATCH v2 0/4] MR2364: wine{alsa,coreaudio,oss,pulse}: Use GetModuleFileName() instead of hardcoded module filename for registry key.
by Huw Davies (＠huw) March 23, 2023

March 23, 2023

On Thu Mar 23 03:02:29 2023 +0000, Davide Beatrici wrote: > How should we proceed then? Well, let's leave the default endpoints in pulse for now, but don't add them to any other drivers. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/2364#note_27609

1 0

Re: [PATCH v10 0/1] MR2183: winecfg: Add an option to set WinRT app dark theme.
by Mohamad Al-Jaf (＠maljaf) March 23, 2023

March 23, 2023

On Wed Mar 22 08:48:00 2023 +0000, Alexandre Julliard wrote: > These strings should be translatable. How's this? Thanks for the review! :smiley: -- https://gitlab.winehq.org/wine/wine/-/merge_requests/2183#note_27604

1 0

Re: [PATCH v10 0/1] MR2183: winecfg: Add an option to set WinRT app dark theme.
by Mohamad Al-Jaf (＠maljaf) March 23, 2023

March 23, 2023

On Wed Mar 22 08:48:00 2023 +0000, Alexandre Julliard wrote: > It's a dword key, treating it as a string is ugly. I agree. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/2183#note_27603

1 0