Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
Incomplete fix for Emacs CVE-2024-53920 allows arbitrary code execution when viewing or editing untrusted files in non-Lisp modes like Perl flymake.
Bas Alberts of GitHub Security Lab discovered that the patch for CVE-2024-53920, an arbitrary code execution flaw in Emacs, was incomplete. Code execution remains possible when viewing or editing untrusted text files in modes other than Emacs Lisp mode, for example Perl files with flymake mode enabled. All Emacs versions affected by the original CVE remain affected by the incomplete fix.
- Incomplete fix for CVE-2024-53920 found by GitHub Security Lab's Bas Alberts.
- Arbitrary code execution persists via non-Emacs-Lisp modes when opening untrusted files.
- PoC uses Perl flymake mode to run system() on file open.
- All Emacs versions affected by the original CVE remain vulnerable.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-53920 | In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.) NVD description · AI analysis pending | 7.8 | <1% |
| — |
Posted by Sean Whitton on Sep 14 Bas Alberts of the GitHub Security Lab discovered that the fix for CVE-2024-53920, an arbitrary code execution flaw in Emacs, was incomplete. Viewing or editing untrusted text files in modes other than Emacs Lisp mode can also permit arbitrary code execution. For example: #!/usr/bin/perl # -*- mode: perl; mode: flymake -*- BEGIN { system("touch uh_oh.txt"); } This problem affects all Emacs versions affected by...
This source does not provide full text. Read it at seclists.org.