Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
Incomplete fix for Emacs CVE-2024-53920 allows arbitrary code execution when viewing or editing untrusted files in non-Lisp modes like Perl flymake.
Bas Alberts of GitHub Security Lab discovered that the patch for CVE-2024-53920, an arbitrary code execution flaw in Emacs, was incomplete. Code execution remains possible when viewing or editing untrusted text files in modes other than Emacs Lisp mode, for example Perl files with flymake mode enabled. All Emacs versions affected by the original CVE remain affected by the incomplete fix.
- Incomplete fix for CVE-2024-53920 found by GitHub Security Lab's Bas Alberts.
- Arbitrary code execution persists via non-Emacs-Lisp modes when opening untrusted files.
- PoC uses Perl flymake mode to run system() on file open.
- All Emacs versions affected by the original CVE remain vulnerable.
- CVEs
- CVE-2024-53920
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-53920 | In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can… | 7.8 | <1% |
From the original article
Posted by Sean Whitton on Sep 14 Bas Alberts of the GitHub Security Lab discovered that the fix for CVE-2024-53920, an arbitrary code execution flaw in Emacs, was incomplete. Viewing or editing untrusted text files in modes other than Emacs Lisp mode can also permit arbitrary code execution. For example: #!
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.