Page History

The getenv() function searches an environment list for a string that matches a specified name , and returns a pointer to a string associated with the matched list member. Due to the way environment variables are stored.

Subclause 7.22.4.6 of the C Standard [ISO/IEC 9899:2011] states:

The set of environment names and the method for altering the environment list are implementation-defined.

Depending on the implementation, multiple environment variables with the same name may be allowed and can cause unexpected results .

Implementation Details

Depending on the implementation, if a program may not cannot consistently choose the same value if there are multiple environment variables with the same name. The GNU glibc library attempts to deal with addresses this issue in getenv() and setenv() by always using the first variable it comes across, encounters and ignoring the rest. unsetenv() will remove all the entries matching the variable name. Other implementations are following this lead.

Non-Compliant Coding Example

Do not use different methods to get environment variables, as you may end up checking one value, but actually returning another.

Compliant Solution

However, it is unwise to rely on this behavior.

One common difference between implementations is whether or not environment variables are case sensitive. Although UNIX-like implementations are generally case sensitive, environment variables are "not case sensitive in Windows 98/Me and Windows NT/2000/XP" [MSDN].

Duplicate Environment Variable Detection (POSIX)

The following code defines a function that uses the POSIX environ array to manually search for duplicate key entries. Any duplicate environment variables are considered an attack, so the program immediately terminates if a duplicate is detectedThe glibc getenv() and setenv() functions will always choose the same value, so using them is a good option.

extern 
char *temp*environ;
char *copy;

if ((temp = getenv("TEST_ENV")) != NULL) {
  copy= malloc(strlen(temp) + 1);
  if (copy != NULL) {
    strcpy(copy, temp);
  }
  else {
    /* handle error condition */
  }

  copy[0] = 'a';
  setenv("TEST_ENV", copy, 1);
}
else {
  return -1;
}

In addition, you could search through environ to see if there are multiple entries for a variable. Upon finding something, simply abort(). It is very unlikely that there would be a need for more than one variable of the same name.

Risk Assessment

An adversary could create several environment variables with the same name. If the program checks against one copy, but actually uses another, this could be a clear problem.

int main(void) {
  if (multiple_vars_with_same_name()) {
    printf("Someone may be tampering.\n");
    return 1;
  }

  /* ... */

  return 0;
}

int multiple_vars_with_same_name(void) {
  size_t i;
  size_t j;
  size_t k;
  size_t l;
  size_t len_i;
  size_t len_j;

  for(size_t i = 0; environ[i] != NULL; i++) {
    for(size_t j = i; environ[j] != NULL; j++) {
      if (i != j) {
        k = 0;
        l = 0;

        len_i = strlen(environ[i]);
        len_j = strlen(environ[j]);

        while (k < len_i && l < len_j) {
          if (environ[i][k] != environ[j][l])
            break;

          if (environ[i][k] == '=')
            return 1;

          k++;
          l++;
        }
      }
    }
  }
  return 0;
}

Noncompliant Code Example

This noncompliant code example behaves differently when compiled and run on Linux and Microsoft Windows platforms:

if (putenv("TEST_ENV=foo") != 0) {
  /* Handle error */
}
if (putenv("Test_ENV=bar") != 0) {
  /* Handle error */
}

const char *temp = getenv("TEST_ENV");

if (temp == NULL) {
  /* Handle error */
}

printf("%s\n", temp);

On an IA-32 Linux machine with GCC 3.4.4, this code prints

foo

whereas, on an IA-32 Windows XP machine with Microsoft Visual C++ 2008 Express, it prints

bar

Compliant Solution

Portable code should use environment variables that differ by more than capitalization:

if (putenv("TEST_ENV=foo") != 0) {
  /* Handle error */
}
if (putenv("OTHER_ENV=bar") != 0) {
  /* Handle error */
}

const char *temp = getenv("TEST_ENV");

if (temp == NULL) {
  /* Handle error */
}

printf("%s\n", temp);

Risk Assessment

An attacker can create multiple environment variables with the same name (for example, by using the POSIX execve() function). If the program checks one copy but uses another, security checks may be circumvented.

Automated Detection

References

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...

Image Added Image Added Image Added Wiki Markup\[[ISO/IEC 9899-1999:TC2|AA. C References#ISO/IEC 9899-1999TC]\] Section 7.20.4, "Communication with the environment"