diff options
Diffstat (limited to 'meta/recipes-core/glibc/glibc/CVE-2021-38604.patch')
-rw-r--r-- | meta/recipes-core/glibc/glibc/CVE-2021-38604.patch | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/CVE-2021-38604.patch b/meta/recipes-core/glibc/glibc/CVE-2021-38604.patch new file mode 100644 index 0000000000..36fd4a61b2 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/CVE-2021-38604.patch | |||
@@ -0,0 +1,41 @@ | |||
1 | From b805aebd42364fe696e417808a700fdb9800c9e8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Nikita Popov <npv1310@gmail.com> | ||
3 | Date: Mon, 9 Aug 2021 20:17:34 +0530 | ||
4 | Subject: [PATCH] librt: fix NULL pointer dereference (bug 28213) | ||
5 | |||
6 | Helper thread frees copied attribute on NOTIFY_REMOVED message | ||
7 | received from the OS kernel. Unfortunately, it fails to check whether | ||
8 | copied attribute actually exists (data.attr != NULL). This worked | ||
9 | earlier because free() checks passed pointer before actually | ||
10 | attempting to release corresponding memory. But | ||
11 | __pthread_attr_destroy assumes pointer is not NULL. | ||
12 | |||
13 | So passing NULL pointer to __pthread_attr_destroy will result in | ||
14 | segmentation fault. This scenario is possible if | ||
15 | notification->sigev_notify_attributes == NULL (which means default | ||
16 | thread attributes should be used). | ||
17 | |||
18 | Signed-off-by: Nikita Popov <npv1310@gmail.com> | ||
19 | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> | ||
20 | |||
21 | Upstream-Status: Backport | ||
22 | CVE: CVE-2021-38604 | ||
23 | Signed-off-by: Armin Kuser <akuster@mvista.com> | ||
24 | |||
25 | --- | ||
26 | sysdeps/unix/sysv/linux/mq_notify.c | 2 +- | ||
27 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
28 | |||
29 | Index: git/sysdeps/unix/sysv/linux/mq_notify.c | ||
30 | =================================================================== | ||
31 | --- git.orig/sysdeps/unix/sysv/linux/mq_notify.c | ||
32 | +++ git/sysdeps/unix/sysv/linux/mq_notify.c | ||
33 | @@ -134,7 +134,7 @@ helper_thread (void *arg) | ||
34 | to wait until it is done with it. */ | ||
35 | (void) __pthread_barrier_wait (¬ify_barrier); | ||
36 | } | ||
37 | - else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED) | ||
38 | + else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED && data.attr != NULL) | ||
39 | { | ||
40 | /* The only state we keep is the copy of the thread attributes. */ | ||
41 | pthread_attr_destroy (data.attr); | ||