IO.UT.PROC : Untrusted Process Creation

Summary

A process creation function is called with an untrusted process name argument.

A process name argument is considered to be untrusted if:

• There is a set of applicable UNTRUSTED_PROC_WHITELIST rules (that is, a set of one or more UNTRUSTED_PROC_WHITELIST rules after which no UNTRUSTED_PROC_WHITELIST= or UNTRUSTED_PROC_BLACKLIST rules occur), and either
  • the process name argument does not match one of the rules in that set,
    or
  • CodeSonar cannot determine the value of the process name argument.
  or
• There is a set of applicable UNTRUSTED_PROC_BLACKLIST rules (that is, a set of one or more UNTRUSTED_PROC_BLACKLIST rules after which no UNTRUSTED_PROC_BLACKLIST= or UNTRUSTED_PROC_WHITELIST rules occur), and the process name argument matches one of the rules in that set.
  or
• The process name argument is a string constant that may have been obfuscated, where obfuscation determinations depend in part on the settings of configuration parameters MIN_B64_SCORE and MIN_ENC_SCORE.

Properties

WARNING_FILTER += allow class="Untrusted Process Creation"

Triggers

CodeSonar ships with library models that allow it to recognize functions such as libc execv() and Win32 CreateProcessA() that take a process name argument. If one of these functions is called with an untrusted value in the process name parameter position, a warning will be issued.

If you have created a custom library model for some function f() in terms of one of these existing models, calls to f() will also be capable of triggering Untrusted Process Creation warnings.

Example

Suppose the project configuration file contains the following rule (this is part of the factory settings for UNTRUSTED_PROC_BLACKLIST).

UNTRUSTED_PROC_BLACKLIST += ^\s*(.*[/\\])?(a|ba|c|k|pdk|sc|tc|z)?sh(\s+.*)*$

Then CodeSonar will issue one Untrusted Process Creation warning in the following code.

#include <stdlib.h>
#include <stdio.h>


void ut_proc(const char *command)
{
    FILE *pipe_file;

    /* "/usr/bin/myprocess" does not match UNTRUSTED_PROC_BLACKLIST rule */
    if (pipe_file = (FILE*)popen("/usr/bin/myprocess","r")){
      /* ... */
      pclose(pipe_file);
    }

    /* "/usr/bin/sh" forbidden by UNTRUSTED_PROC_BLACKLIST setting */
    if (pipe_file = (FILE*)popen("/usr/bin/sh","r")){ /* 'Untrusted Process Creation' warning issued here */
      /* ... */
      pclose(pipe_file);
    }
}

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

• ASSUME_FUNCPTR_PARAMETERS_MAYBE_FREED
• ASSUME_FUNCPTR_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_FUNCPTR_PARAMETERS_MAYBE_MODIFIED
• ASSUME_OTHER_PARAMETERS_MAYBE_FREED
• ASSUME_OTHER_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_OTHER_PARAMETERS_MAYBE_MODIFIED
• ASSUME_UNDEFINED_PARAMETERS_MAYBE_FREED
• ASSUME_UNDEFINED_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_UNDEFINED_PARAMETERS_MAYBE_MODIFIED
• ASSUME_VARARG_PARAMETERS_MAYBE_FREED
• ASSUME_VARARG_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_VARARG_PARAMETERS_MAYBE_MODIFIED
• CALL_SITE_EXPANSIONS
• CALL_SITE_EXPANSION_BOUND
• CPU_SPEED_ADJUSTMENT
• DISABLED_TAINT_KINDS
• DIV_BY_ZERO_CRASHES
• DIV_OVERFLOW_CRASHES
• DP_REFINEMENT_APPROXIMATE
• DP_REFINEMENT_APPROXIMATE_DISMISS
• DP_REFINEMENT_APPROXIMATE_DISMISS_TIMEOUT
• DP_REFINEMENT_APPROXIMATE_TIMEOUT
• DP_REFINEMENT_EXACT
• DP_REFINEMENT_EXACT_DISMISS
• DP_REFINEMENT_EXACT_DISMISS_TIMEOUT
• DP_REFINEMENT_EXACT_TIMEOUT
• EXPLORE_MORE_LOOP_PATHS
• EXPLORE_SELF_ASSIGNMENT
• FLOAT_IS_ADVERSARIAL
• FUNCTION_MAP
• FUNCTION_POINTER_RESOLUTION
• IGNORE_CPP_CODE
• IMPLICIT_INITIALIZER_ELT_LIMIT
• INFER_CONST
• LOOP_COUNTER_DISTRUST
• LOOP_TAINT_TRANSFER
• MAX_ALLOCATION_SIZE
• MAX_ATTEMPTED_SIMILAR_PATHS
• MAX_CHECKED_FUNCTION_POINTER_RESOLVENTS
• MAX_CHECKED_INPUTS_PER_PROCEDURE
• MAX_CHECKS_PER_INPUT
• MAX_CHECK_COMPLEXITY
• MAX_CLOBBERED_FIELDS
• MAX_COPIED_FIELDS
• MAX_EXPRESSION_COMPLEXITY
• MAX_GLOBAL_CHECK_AGE
• MAX_MODIFIED_VALUES
• MAX_PERCENT_F_CHARACTERS
• MAX_PERCENT_LF_CHARACTERS
• MAX_POINTER_ANALYSIS_PASSES
• MAX_SIMILAR_PATHS
• MAX_SUMMARIES_PER_PROCEDURE
• MIN_B64_SCORE
• MIN_ENC_SCORE
• NULL_POINTER_DEREF_CRASHES
• NULL_SENTINEL_CHAR_SIZE
• PARAMETER_EVALUATION_ORDER
• PATH_FINDING_EFFORT
• PATH_SHORTENING_EFFORT
• REACHABILITY_ROOTS
• REFINEMENT_BARRIER_PERIOD
• REPORT_IMPLIED_EQUALITY
• REPORT_IMPLIED_INEQUALITY
• REPORT_SIMILAR_WARNINGS
• ROLLBACK_SUMMARIES_ON_ABORT
• SEARCH_BOUND
• SEARCH_BOUND_NOISE_THRESHOLD
• SYSTEM_INCLUDE_PATHS
• TAINT_CALLSITE_EXPANSION_EFFORT
• TAINT_MAX_MODIFIED_VALUES
• TAINT_MAX_WARNING_PATH_LENGTH
• TAINT_SEARCH_BOUND
• TIME_LIMIT_INTER_CLASSIFY
• TIME_LIMIT_INTRA_CLASSIFY
• TIME_LIMIT_INTRA_EXPLORE
• TIME_LIMIT_REFINE
• TIME_LIMIT_RESOLVE
• TIME_LIMIT_TAINT_REFINE
• TIME_LIMIT_TAINT_REFINE_PER_PROCEDURE
• UNINITIALIZED_GLOBALS
• UNTRUSTED_PROC_BLACKLIST
• UNTRUSTED_PROC_WHITELIST
• VOLATILE_TREATMENT
• WARNING_FILTER