From dd30c9d0cab364eecd2ad387817568f699231733 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Fri, 8 Sep 2017 07:34:19 +0200 Subject: glibc: CVE-2017-1000366 glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Reference: https://security-tracker.debian.org/tracker/CVE-2017-1000366 Signed-off-by: Sona Sarmadi Signed-off-by: Martin Borg --- recipes-core/glibc/glibc/CVE-2017-1000366.patch | 53 +++++++++++++++++++++++++ recipes-core/glibc/glibc_%.bbappend | 6 +++ 2 files changed, 59 insertions(+) create mode 100644 recipes-core/glibc/glibc/CVE-2017-1000366.patch create mode 100644 recipes-core/glibc/glibc_%.bbappend diff --git a/recipes-core/glibc/glibc/CVE-2017-1000366.patch b/recipes-core/glibc/glibc/CVE-2017-1000366.patch new file mode 100644 index 0000000..8ba9c5c --- /dev/null +++ b/recipes-core/glibc/glibc/CVE-2017-1000366.patch @@ -0,0 +1,53 @@ +From f6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Mon, 19 Jun 2017 17:09:55 +0200 +Subject: [PATCH] CVE-2017-1000366: Ignore LD_LIBRARY_PATH for AT_SECURE=1 + programs [BZ #21624] + +LD_LIBRARY_PATH can only be used to reorder system search paths, which +is not useful functionality. + +This makes an exploitable unbounded alloca in _dl_init_paths unreachable +for AT_SECURE=1 programs. + +CVE: CVE-2017-1000366 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=3c7cd21290cabdadd72984fb69bc51e64ff1002d] + +Signed-off-by: Sona Sarmadi +--- + ChangeLog | 7 +++++++ + elf/rtld.c | 3 ++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/ChangeLog b/ChangeLog +index f140ee6..7bfdf45 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,10 @@ ++2017-06-19 Florian Weimer ++ ++ [BZ #21624] ++ CVE-2017-1000366 ++ * elf/rtld.c (process_envvars): Ignore LD_LIBRARY_PATH for ++ __libc_enable_secure. ++ + 2017-02-05 Siddhesh Poyarekar + + * version.h (RELEASE): Set to "stable" +diff --git a/elf/rtld.c b/elf/rtld.c +index a036ece..2fc33a6 100644 +--- a/elf/rtld.c ++++ b/elf/rtld.c +@@ -2418,7 +2418,8 @@ process_envvars (enum mode *modep) + + case 12: + /* The library search path. */ +- if (memcmp (envline, "LIBRARY_PATH", 12) == 0) ++ if (!__libc_enable_secure ++ && memcmp (envline, "LIBRARY_PATH", 12) == 0) + { + library_path = &envline[13]; + break; +-- +1.9.1 + diff --git a/recipes-core/glibc/glibc_%.bbappend b/recipes-core/glibc/glibc_%.bbappend new file mode 100644 index 0000000..1ef0688 --- /dev/null +++ b/recipes-core/glibc/glibc_%.bbappend @@ -0,0 +1,6 @@ +# look for files in the layer first +FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" + +SRC_URI += "file://CVE-2017-1000366.patch \ + " + -- cgit v1.2.3-54-g00ecf