diff options
author | Armin Kuster <akuster@mvista.com> | 2021-01-14 11:51:17 -0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-01-21 23:08:16 +0000 |
commit | 267a3dea46ec0bd97a02aef25417023a5a570e34 (patch) | |
tree | 8ba12ab805646dd12425d4b6d2f0bd7b4fb65a46 /meta/recipes-core | |
parent | 26ebdf3f4f6d43a3aaac579a676ed0bc56a00336 (diff) | |
download | poky-267a3dea46ec0bd97a02aef25417023a5a570e34.tar.gz |
glibc: Security fix for CVE-2020-29573
Source: glibc.org
MR: 107580
Type: Security Fix
Disposition: Backport from https://sourceware.org/git/?p=glibc.git;a=commit;h=681900d29683722b1cb0a8e565a0585846ec5a61
ChangeID: 7bc5edb2e1947ac0774a453000a1568bbe3bb7d2
Description:
Fixedup to match 2.31 context. ldbl2mpn.c is in i386 for this version
(From OE-Core rev: 3cabc58417cb5d69a018aec9c818fec63db18336)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-core')
-rw-r--r-- | meta/recipes-core/glibc/glibc/CVE-2020-29573.patch | 128 | ||||
-rw-r--r-- | meta/recipes-core/glibc/glibc_2.31.bb | 1 |
2 files changed, 129 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/CVE-2020-29573.patch b/meta/recipes-core/glibc/glibc/CVE-2020-29573.patch new file mode 100644 index 0000000000..1e75f2d29d --- /dev/null +++ b/meta/recipes-core/glibc/glibc/CVE-2020-29573.patch | |||
@@ -0,0 +1,128 @@ | |||
1 | From 681900d29683722b1cb0a8e565a0585846ec5a61 Mon Sep 17 00:00:00 2001 | ||
2 | From: Florian Weimer <fweimer@redhat.com> | ||
3 | Date: Tue, 22 Sep 2020 19:07:48 +0200 | ||
4 | Subject: [PATCH] x86: Harden printf against non-normal long double values (bug | ||
5 | 26649) | ||
6 | |||
7 | The behavior of isnan/__builtin_isnan on bit patterns that do not | ||
8 | correspond to something that the CPU would produce from valid inputs | ||
9 | is currently under-defined in the toolchain. (The GCC built-in and | ||
10 | glibc disagree.) | ||
11 | |||
12 | The isnan check in PRINTF_FP_FETCH in stdio-common/printf_fp.c | ||
13 | assumes the GCC behavior that returns true for non-normal numbers | ||
14 | which are not specified as NaN. (The glibc implementation returns | ||
15 | false for such numbers.) | ||
16 | |||
17 | At present, passing non-normal numbers to __mpn_extract_long_double | ||
18 | causes this function to produce irregularly shaped multi-precision | ||
19 | integers, triggering undefined behavior in __printf_fp_l. | ||
20 | |||
21 | With GCC 10 and glibc 2.32, this behavior is not visible because | ||
22 | __builtin_isnan is used, which avoids calling | ||
23 | __mpn_extract_long_double in this case. This commit updates the | ||
24 | implementation of __mpn_extract_long_double so that regularly shaped | ||
25 | multi-precision integers are produced in this case, avoiding | ||
26 | undefined behavior in __printf_fp_l. | ||
27 | |||
28 | Upstream-Status: Backport [git://sourceware.org/git/glibc.git] | ||
29 | CVE: CVE-2020-29573 | ||
30 | Signed-off-By: Armin Kuster <akuster@mvista.com> | ||
31 | |||
32 | --- | ||
33 | sysdeps/x86/Makefile | 4 ++ | ||
34 | sysdeps/x86/ldbl2mpn.c | 8 ++++ | ||
35 | sysdeps/x86/tst-ldbl-nonnormal-printf.c | 52 +++++++++++++++++++++++++ | ||
36 | 3 files changed, 64 insertions(+) | ||
37 | create mode 100644 sysdeps/x86/tst-ldbl-nonnormal-printf.c | ||
38 | |||
39 | Index: git/sysdeps/x86/Makefile | ||
40 | =================================================================== | ||
41 | --- git.orig/sysdeps/x86/Makefile | ||
42 | +++ git/sysdeps/x86/Makefile | ||
43 | @@ -9,6 +9,10 @@ tests += tst-get-cpu-features tst-get-cp | ||
44 | tests-static += tst-get-cpu-features-static | ||
45 | endif | ||
46 | |||
47 | +ifeq ($(subdir),math) | ||
48 | +tests += tst-ldbl-nonnormal-printf | ||
49 | +endif # $(subdir) == math | ||
50 | + | ||
51 | ifeq ($(subdir),setjmp) | ||
52 | gen-as-const-headers += jmp_buf-ssp.sym | ||
53 | sysdep_routines += __longjmp_cancel | ||
54 | Index: git/sysdeps/x86/tst-ldbl-nonnormal-printf.c | ||
55 | =================================================================== | ||
56 | --- /dev/null | ||
57 | +++ git/sysdeps/x86/tst-ldbl-nonnormal-printf.c | ||
58 | @@ -0,0 +1,52 @@ | ||
59 | +/* Test printf with x86-specific non-normal long double value. | ||
60 | + Copyright (C) 2020 Free Software Foundation, Inc. | ||
61 | + | ||
62 | + This file is part of the GNU C Library. | ||
63 | + | ||
64 | + The GNU C Library is free software; you can redistribute it and/or | ||
65 | + modify it under the terms of the GNU Lesser General Public | ||
66 | + License as published by the Free Software Foundation; either | ||
67 | + version 2.1 of the License, or (at your option) any later version. | ||
68 | + | ||
69 | + The GNU C Library is distributed in the hope that it will be useful, | ||
70 | + but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
71 | + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
72 | + Lesser General Public License for more details. | ||
73 | + | ||
74 | + You should have received a copy of the GNU Lesser General Public | ||
75 | + License along with the GNU C Library; if not, see | ||
76 | + <https://www.gnu.org/licenses/>. */ | ||
77 | + | ||
78 | +#include <stdio.h> | ||
79 | +#include <string.h> | ||
80 | +#include <support/check.h> | ||
81 | + | ||
82 | +/* Fill the stack with non-zero values. This makes a crash in | ||
83 | + snprintf more likely. */ | ||
84 | +static void __attribute__ ((noinline, noclone)) | ||
85 | +fill_stack (void) | ||
86 | +{ | ||
87 | + char buffer[65536]; | ||
88 | + memset (buffer, 0xc0, sizeof (buffer)); | ||
89 | + asm ("" ::: "memory"); | ||
90 | +} | ||
91 | + | ||
92 | +static int | ||
93 | +do_test (void) | ||
94 | +{ | ||
95 | + fill_stack (); | ||
96 | + | ||
97 | + long double value; | ||
98 | + memcpy (&value, "\x00\x04\x00\x00\x00\x00\x00\x00\x00\x04", 10); | ||
99 | + | ||
100 | + char buf[30]; | ||
101 | + int ret = snprintf (buf, sizeof (buf), "%Lg", value); | ||
102 | + TEST_COMPARE (ret, strlen (buf)); | ||
103 | + if (strcmp (buf, "nan") != 0) | ||
104 | + /* If snprintf does not recognize the non-normal number as a NaN, | ||
105 | + it has added the missing explicit MSB. */ | ||
106 | + TEST_COMPARE_STRING (buf, "3.02201e-4624"); | ||
107 | + return 0; | ||
108 | +} | ||
109 | + | ||
110 | +#include <support/test-driver.c> | ||
111 | Index: git/sysdeps/i386/ldbl2mpn.c | ||
112 | =================================================================== | ||
113 | --- git.orig/sysdeps/i386/ldbl2mpn.c | ||
114 | +++ git/sysdeps/i386/ldbl2mpn.c | ||
115 | @@ -115,6 +115,12 @@ __mpn_extract_long_double (mp_ptr res_pt | ||
116 | && res_ptr[N - 1] == 0) | ||
117 | /* Pseudo zero. */ | ||
118 | *expt = 0; | ||
119 | - | ||
120 | + else | ||
121 | + /* The sign bit is explicit, but add it in case it is missing in | ||
122 | + the input. Otherwise, callers will not be able to produce the | ||
123 | + expected multi-precision integer layout by shifting the sign | ||
124 | + bit into the MSB. */ | ||
125 | + res_ptr[N - 1] |= (mp_limb_t) 1 << (LDBL_MANT_DIG - 1 | ||
126 | + - ((N - 1) * BITS_PER_MP_LIMB)); | ||
127 | return N; | ||
128 | } | ||
diff --git a/meta/recipes-core/glibc/glibc_2.31.bb b/meta/recipes-core/glibc/glibc_2.31.bb index 3a0d60abf8..067d4de64a 100644 --- a/meta/recipes-core/glibc/glibc_2.31.bb +++ b/meta/recipes-core/glibc/glibc_2.31.bb | |||
@@ -42,6 +42,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ | |||
42 | file://0028-inject-file-assembly-directives.patch \ | 42 | file://0028-inject-file-assembly-directives.patch \ |
43 | file://0029-locale-prevent-maybe-uninitialized-errors-with-Os-BZ.patch \ | 43 | file://0029-locale-prevent-maybe-uninitialized-errors-with-Os-BZ.patch \ |
44 | file://CVE-2020-29562.patch \ | 44 | file://CVE-2020-29562.patch \ |
45 | file://CVE-2020-29573.patch \ | ||
45 | " | 46 | " |
46 | S = "${WORKDIR}/git" | 47 | S = "${WORKDIR}/git" |
47 | B = "${WORKDIR}/build-${TARGET_SYS}" | 48 | B = "${WORKDIR}/build-${TARGET_SYS}" |