diff options
Diffstat (limited to 'meta/recipes-core/glibc/glibc/0001-CVE-2017-1000366-Ignore-LD_LIBRARY_PATH-for-AT_SECUR.patch')
-rw-r--r-- | meta/recipes-core/glibc/glibc/0001-CVE-2017-1000366-Ignore-LD_LIBRARY_PATH-for-AT_SECUR.patch | 71 |
1 files changed, 71 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/0001-CVE-2017-1000366-Ignore-LD_LIBRARY_PATH-for-AT_SECUR.patch b/meta/recipes-core/glibc/glibc/0001-CVE-2017-1000366-Ignore-LD_LIBRARY_PATH-for-AT_SECUR.patch new file mode 100644 index 0000000000..78e9ea9e65 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0001-CVE-2017-1000366-Ignore-LD_LIBRARY_PATH-for-AT_SECUR.patch | |||
@@ -0,0 +1,71 @@ | |||
1 | From 400f170750a4b2c94a2670ca44de166cc5dd6e3b Mon Sep 17 00:00:00 2001 | ||
2 | From: Florian Weimer <fweimer@redhat.com> | ||
3 | Date: Mon, 19 Jun 2017 18:33:26 +0200 | ||
4 | Subject: [PATCH] CVE-2017-1000366: Ignore LD_LIBRARY_PATH for AT_SECURE=1 | ||
5 | programs [BZ #21624] | ||
6 | |||
7 | LD_LIBRARY_PATH can only be used to reorder system search paths, which | ||
8 | is not useful functionality. | ||
9 | |||
10 | This makes an exploitable unbounded alloca in _dl_init_paths unreachable | ||
11 | for AT_SECURE=1 programs. | ||
12 | |||
13 | (cherry picked from commit f6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d) | ||
14 | |||
15 | Upstream-Status: Backport | ||
16 | https://sourceware.org/git/?p=glibc.git;a=commit;h=87bd4186da10371f46e2f1a7bf7c0a45bb04f1ac | ||
17 | https://anonscm.debian.org/cgit/pkg-glibc/glibc.git/commit/?h=stretch&id=2755c57269f24e9d59c22c49788f92515346c1bb | ||
18 | |||
19 | CVE: CVE-2017-1000366 | ||
20 | |||
21 | Signed-off-by: George McCollister <george.mccollister@gmail.com> | ||
22 | --- | ||
23 | ChangeLog | 7 +++++++ | ||
24 | NEWS | 1 + | ||
25 | elf/rtld.c | 3 ++- | ||
26 | 3 files changed, 10 insertions(+), 1 deletion(-) | ||
27 | |||
28 | diff --git a/ChangeLog b/ChangeLog | ||
29 | index 2bdaf69e43..7a999802dd 100644 | ||
30 | --- a/ChangeLog | ||
31 | +++ b/ChangeLog | ||
32 | @@ -1,3 +1,10 @@ | ||
33 | +2017-06-19 Florian Weimer <fweimer@redhat.com> | ||
34 | + | ||
35 | + [BZ #21624] | ||
36 | + CVE-2017-1000366 | ||
37 | + * elf/rtld.c (process_envvars): Ignore LD_LIBRARY_PATH for | ||
38 | + __libc_enable_secure. | ||
39 | + | ||
40 | 2016-12-31 Florian Weimer <fweimer@redhat.com> | ||
41 | |||
42 | [BZ #18784] | ||
43 | diff --git a/NEWS b/NEWS | ||
44 | index 4b1ca3cb65..66b49dbbc0 100644 | ||
45 | --- a/NEWS | ||
46 | +++ b/NEWS | ||
47 | @@ -17,6 +17,7 @@ using `glibc' in the "product" field. | ||
48 | question type which is outside the range of valid question type values. | ||
49 | (CVE-2015-5180) | ||
50 | |||
51 | + [21624] Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366) | ||
52 | Version 2.24 | ||
53 | |||
54 | * The minimum Linux kernel version that this version of the GNU C Library | ||
55 | diff --git a/elf/rtld.c b/elf/rtld.c | ||
56 | index 647661ca45..215a9aec8f 100644 | ||
57 | --- a/elf/rtld.c | ||
58 | +++ b/elf/rtld.c | ||
59 | @@ -2437,7 +2437,8 @@ process_envvars (enum mode *modep) | ||
60 | |||
61 | case 12: | ||
62 | /* The library search path. */ | ||
63 | - if (memcmp (envline, "LIBRARY_PATH", 12) == 0) | ||
64 | + if (!__libc_enable_secure | ||
65 | + && memcmp (envline, "LIBRARY_PATH", 12) == 0) | ||
66 | { | ||
67 | library_path = &envline[13]; | ||
68 | break; | ||
69 | -- | ||
70 | 2.15.0 | ||
71 | |||