CVE-2016-9401

popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name	Vendor	Start Version	End Version
Bash	Gnu	*	4.4 (excluding)
Bash	Gnu	4.4-patch1 (including)	4.4-patch1 (including)
Bash	Gnu	4.4-patch2 (including)	4.4-patch2 (including)
Bash	Gnu	4.4-patch3 (including)	4.4-patch3 (including)
Bash	Gnu	4.4-patch4 (including)	4.4-patch4 (including)
Bash	Gnu	4.4-patch5 (including)	4.4-patch5 (including)
Red Hat Enterprise Linux 6	RedHat	bash-0:4.1.2-48.el6	*
Red Hat Enterprise Linux 7	RedHat	bash-0:4.2.46-28.el7	*
Bash	Ubuntu	artful	*
Bash	Ubuntu	bionic	*
Bash	Ubuntu	cosmic	*
Bash	Ubuntu	devel	*
Bash	Ubuntu	disco	*
Bash	Ubuntu	eoan	*
Bash	Ubuntu	esm-infra-legacy/trusty	*
Bash	Ubuntu	esm-infra/bionic	*
Bash	Ubuntu	esm-infra/focal	*
Bash	Ubuntu	esm-infra/xenial	*
Bash	Ubuntu	focal	*
Bash	Ubuntu	groovy	*
Bash	Ubuntu	hirsute	*
Bash	Ubuntu	precise	*
Bash	Ubuntu	precise/esm	*
Bash	Ubuntu	trusty	*
Bash	Ubuntu	trusty/esm	*
Bash	Ubuntu	vivid/stable-phone-overlay	*
Bash	Ubuntu	vivid/ubuntu-core	*
Bash	Ubuntu	xenial	*
Bash	Ubuntu	yakkety	*
Bash	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-9401
CWE	https://cwe.mitre.org/data/definitions/416.html

Use After Free

Weakness

Affected Software

Potential Mitigations

References