Heap-based Buffer Overflow in entr

Executive Summary

This is a heap-based buffer overflow in the entr utility's run_utility() function. The function allocates a fixed-size buffer using malloc(ARG_MAX) and copies command-line arguments into it. It incorrectly calculates remaining space by using strlcpy()'s return value, which reports the source string length rather than bytes written. When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing out-of-bounds writes. Attackers can exploit this by providing overly long arguments or using the /_ substitution feature to expand short tokens into longer paths.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of entr installed on your system. Vulnerable versions are up to and including 5.8. Run `entr --version` to verify. If the version is 5.8 or lower, the system is potentially affected. Additionally, monitor for crashes or memory corruption when entr processes long command-line arguments or uses the /_ substitution feature.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to cause memory corruption, crash the process, or trigger a denial of service. This might lead to application instability, data corruption, or unauthorized code execution depending on the system configuration. Local attackers with access to run entr commands could leverage this to disrupt services or gain control over affected systems.

Useful 0 Not Useful 0

Mitigation Strategies

Update entr to a version that includes the fix in commit 2467fe0. If updating is not immediately possible, avoid using entr with untrusted or overly long command-line arguments. Disable the /_ substitution feature if enabled. Monitor system logs for crashes or memory corruption events related to entr processes.

Useful 0 Not Useful 0