CVE-2018-7548

Vulnerability

In zsh through version 5.4.2, the subst.c file contains a NULL pointer dereference when processing the ${(PA)...} parameter expansion on an empty array result. This flaw occurs because the code does not properly handle the case where the array expansion yields no elements, leading to a segmentation fault. The issue was introduced in an earlier version and affects all releases up to 5.4.2. [1]

Exploitation

An attacker can trigger this vulnerability by providing a crafted input that causes the ${(PA)...} expansion to operate on an empty array. This can be done through a script or command line that uses this specific expansion syntax. No special privileges are required beyond the ability to execute commands in zsh. The exploitation results in a crash of the shell, leading to a denial of service condition. [2][3]

Impact

Successful exploitation causes a denial of service through a NULL pointer dereference, crashing the zsh process. This could be used to disrupt user sessions or automated processes that rely on zsh. There is no evidence of code execution or privilege escalation from this vulnerability alone. [2][3]

Mitigation

The vulnerability is fixed in zsh version 5.5 and later. Users should upgrade to zsh 5.5 or apply the relevant patch from the official repository [1]. For distributions, updates are available as follows: Ubuntu released patches in USN-3593-1 for versions 5.4.2-3ubuntu3.1 (17.10) and others [2]; Gentoo recommends upgrading to >=app-shells/zsh-5.5 [3]. If upgrading is not immediately possible, avoid using ${(PA)...} on potentially empty arrays as a workaround.