Is following code vulnerable?

Question

Consider following C code snippet:

void barfoo (int authstatus) {
    char packet[1024];

    fgets (packet, 1023, stdin);
    if (authstatus != 0)
       system (packet);
    else
       syslog ("Not authorised to process packet");

    return;
}

Attacker can only call this function with auth_status set to 0. Goal of the attacker is to execute code of his choice like spawn a shell. So, can attacker do this in any way if he has to exploit only this function or any function directly related to this function like fgets or system or syslog?

I am unable to find any vulnerability in this. For instance fgets checks for bounds so buffer overflow is not possible.

Answer 1

Your question is:

can attacker do this in any way if he has to exploit only this function or any function directly related to this function like fgets or system or syslog?

And you said in a comment:

we are only familiar with stack based buffer overflow, format string exploits, return to lib c attacks, basic heap based buffer overflow.

So hardware flaws are not within the scope of this question.

I assume that when you say auth_status, you actually mean authstatus.

In that case, I agree with you: No, this code is not vulnerable.

I did find one potential vulnerability: calling fgets() to read some bytes from stdin would affect what happens next time you read stdin. In particular, it would affect what happens next time you call barfoo() (possibly with a different value of authstatus). But this seems like overthinking it, since you said:

there is no other relevant code besides this