NetBSD Problem Report #59837

From www@netbsd.org  Mon Dec 15 05:08:55 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 238381A9239
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 15 Dec 2025 05:08:55 +0000 (UTC)
Message-Id: <20251215050853.B74F61A923A@mollari.NetBSD.org>
Date: Mon, 15 Dec 2025 05:08:53 +0000 (UTC)
From: Keith.S.Thompson@gmail.com
Reply-To: Keith.S.Thompson@gmail.com
To: gnats-bugs@NetBSD.org
Subject: execve allows argv[0] == NULL
X-Send-Pr-Version: www-1.0

>Number:         59837
>Category:       kern
>Synopsis:       execve allows argv[0] == NULL
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Dec 15 05:10:00 +0000 2025
>Last-Modified:  Mon Dec 15 09:40:01 +0000 2025
>Originator:     Keith Thompson
>Release:        NetBSD 10.1/amd64
>Organization:
>Environment:
NetBSD qnetbsd 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
I reproduced the problem in a virtual machine running NetBSD 10.1
under Ubuntu 24.04.3.

I've created a GitHub repo with code to demonstrate the problem.

With an unusual invocation of the execve() system call, it's possible
to invoke a program such that argv[0] is a null pointer. This can
create a security hole; see CVE-2021-4034.

I don't think this is non-conforming, but it can create security
problems for programs that don't check for this condition.

References:

https://github.com/Keith-S-Thompson/argv0

https://nvd.nist.gov/vuln/detail/cve-2021-4034

>How-To-Repeat:
Clone my git repo, run "make", then run "./caller"

-- OR --

caller.c:
```
#include <unistd.h>
int main(void) {
    extern char **environ;
    char *arg0 = NULL;
    execve("./callee", &arg0, environ);
}
```

callee.c:
```
#include <stdio.h>
int main(int argc, char **argv) {
    printf("argc = %d\n", argc);
    for (int i = 0; i <= argc; i ++) {
        printf("argv[%d] = ", i);
        if (argv[i] == NULL) {
            puts("NULL");
        }
        else {
            printf("\"%s\"\n", argv[i]);
        }
    }
}
```

Compile both source files and run "./caller". The output is:
```
argc = 0
argv[0] = NULL
```

The output on a Linux system that has a fix for this problem is:
```
argc = 1
argv[0] = ""
argv[1] = NULL
```
>Fix:
Unknown, but my git repo cites a fix for the corresponding issue
in the Linux kernel. FreeBSD 14.2 apparently also has a fix for it.

>Audit-Trail:
From: Leonardo Taccari <leot@NetBSD.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/59837: execve allows argv[0] == NULL
Date: Mon, 15 Dec 2025 10:36:01 +0100

 Please also see:

  PR kern/56673: don't allow execve with NULL argv

 (Leaving there because this was already discussed and if in some way on
 PR get addressed we should probably also address the other and/or
 possibly close this as duplicate)

Home	PR Database Search