Bash CVE-2019-18276: Restricted Shell Bypass via Implicit Builtin Loading

CVE-2019-18276 is a restricted shell escape in bash where attempting to enable a non-existent builtin triggers implicit dynamic loading of a shared object file, bypassing the security checks that prevent explicit dynamic loading in restricted mode. This allows an attacker to execute arbitrary code by placing a malicious .so file in the current directory or BASH_LOADABLES_PATH and then using the enable command with a non-existent builtin name.

Examined bash-5.0 source, specifically the enable builtin (builtins/enable.def). Found that while explicit enable -f filename has a restricted mode check at lines 165-170, implicit loading triggered by EX_NOTFOUND returns from enable_shell_command() does not perform the same check. Traced git history from bash-5.0 (2019) through to bash-5.2+, where the implicit loading feature was added (commit 0edd0a91, Aug 2021) without restricted mode protection, then later fixed (commit b3d8c8a4, May 2024) by adding && restricted == 0 check. The vulnerability allows bypassing all restricted shell protections through a simple enable nonexistent command in the dyn_load_builtin() code path.", "solution_description": "The vulnerability is patched by adding an explicit check for restricted mode before attempting implicit dynamic loading of builtins. When enable_shell_command() returns EX_NOTFOUND (indicating the builtin doesn't exist), the code should only attempt dyn_load_builtin() if the shell is not in restricted mode. This requires wrapping the implicit loading logic with: #if defined (RESTRICTED_SHELL) ... && restricted == 0 #endif. The fix ensures parity between explicit -f flag checks and implicit loading attempts.", "verification_notes": "The vulnerability was confirmed through git history analysis, with the malicious behavior introduced in commit 0edd0a91 (2021-08-02) and fixed in commit b3d8c8a4 (2024-05-13). The fix adds the required restricted == 0 check to the implicit loading code path.", "bug_class": "restricted-bypass", "severity": "critical", "error_type": "Restricted Shell Escape", "error_category": "auth", "root_cause_type": "logic_bug", "lang": "bash", "tags": ["restricted-bypass", "bash", "CVE-2019-18276", "cold-baseline", "dynamic-loading"], "lib_versions": {"bash": "5.0"}, "artifacts": [ { "kind": "code-excerpt", "content": "/* Line 165-169 in enable.def: explicit -f flag check */\n#if defined (RESTRICTED_SHELL)\n if (restricted && (flags & (FFLAG|DFLAG)))\n {\n sh_restricted ((char )NULL);", "role": "manifests", "source_path": "builtins/enable.def", "source_lines": [163, 170] }, { "kind": "code-excerpt", "content": "/ Implicit loading bypasses this check */\nif (opt == EX_NOTFOUND)\n {\n int dflags, r;\n dflags = ENABLED|SILENT|((flags & SFLAG) ? SPECIAL : 0);\n r = dyn_load_builtin (list, dflags, list->word->word);", "role": "manifests", "source_path": "builtins/enable.def", "source_lines": [224, 243] } ] }