Add advisory for stack buffer overflow with whoami

[sunshowers]

See:

• Crash on illumos due to different passwd struct definition ardaku/whoami#91
• Create RUSTSEC advisory for illumos stack buffer overflow for 1.4.x ardaku/whoami#97

Questions:

• Some other Unix platforms may also be affected. It's hard to enumerate a full list here, but happy to add them as they come to mind for people.

[Shnatsel]

Thanks for the report! Just a few minor tweaks and it's ready to go!

[Shnatsel]

Suggested change

	os = ["illumos"]
	os = ["illumos","solaris"]

FYI the full lists of recognized platforms can be found at https://docs.rs/platforms/latest/platforms/target/enum.OS.html

[sunshowers]

Thanks. I just wasn't sure whether Solaris is affected because I don't have access to their man pages or a running machine.

From https://docs.rs/platforms/latest/platforms/target/enum.OS.html I can't tell what the other Unix platforms are.

I'm also unsure whether the other Apple platforms (iOS, tvOS, watchOS?) are affected. They would probably be affected if it was possible to build and run binaries with whoami on them, but I don't know if that's the case in reality.

[sunshowers]

I'll add Solaris because the preponderance of evidence suggests it is affected.

[Shnatsel]

The platforms crate doesn't expose the unix-ness right now, even though rustc is aware of it. So I've written a shell script to list all Unix OSs:

rustc --print=target-list | while read TARGET; do rustc --print=cfg --target="$TARGET" | grep -q 'unix' && rustc --print=cfg --target="$TARGET" | grep 'target_os' | cut -d '=' -f 2-; done | sort -u

This is the result:

"aix"
"android"
"dragonfly"
"emscripten"
"espidf"
"freebsd"
"fuchsia"
"haiku"
"horizon"
"hurd"
"illumos"
"ios"
"l4re"
"linux"
"macos"
"netbsd"
"nto"
"openbsd"
"redox"
"solaris"
"tvos"
"vita"
"vxworks"
"watchos"

[sunshowers]

Ahh, so some of those of those platforms would also be affected and I guess the advisory may need to be updated. Any platform where the passwd struct doesn't match Linux's, and isn't part of the other named list of platforms, is affected.

I went through a few of them by hand:

• AIX is accidentally okay because the passwd struct matches Linux.
• Fuchsia is okay, I think? I can't find the source code but this struct has all the fields, though they're in alphabetical order.
• Android is okay per this struct.

It's hard to go through every single platform, so if you have suggestions for a better way to do this, or some kind of other catch-all, I'd love that.

[Shnatsel]

The advisory db format doesn't support platform selectors, only a list.

Sadly I am not aware of a resource that would aggregate and/or diff the C APIs from different platforms.

[AldaronLau]

Would it be important to note that this doesn't affect whoami < 0.5.3 (from 5 years ago)?

This is also a problem on freebsd, dragonfly, bitrig, openbsd, netbsd with whoami >= 0.5.3, < 1.0.1 (not sure if that would count separately from this or not).

[AldaronLau]

Also just noticed this affects not only whoami::username(), but additionally whoami::realname(), whoami::username_os(), and whoami::realname_os().

[Shnatsel]

Yes, that would be useful. We have the unaffected field for that.

[sunshowers]

Thanks. I'll send an update shortly.