diff options
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-core/glibc/glibc/CVE-2021-38604.patch | 41 | ||||
-rw-r--r-- | meta/recipes-core/glibc/glibc_2.31.bb | 1 |
2 files changed, 42 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/CVE-2021-38604.patch b/meta/recipes-core/glibc/glibc/CVE-2021-38604.patch new file mode 100644 index 0000000000..36fd4a61b2 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/CVE-2021-38604.patch | |||
@@ -0,0 +1,41 @@ | |||
1 | From b805aebd42364fe696e417808a700fdb9800c9e8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Nikita Popov <npv1310@gmail.com> | ||
3 | Date: Mon, 9 Aug 2021 20:17:34 +0530 | ||
4 | Subject: [PATCH] librt: fix NULL pointer dereference (bug 28213) | ||
5 | |||
6 | Helper thread frees copied attribute on NOTIFY_REMOVED message | ||
7 | received from the OS kernel. Unfortunately, it fails to check whether | ||
8 | copied attribute actually exists (data.attr != NULL). This worked | ||
9 | earlier because free() checks passed pointer before actually | ||
10 | attempting to release corresponding memory. But | ||
11 | __pthread_attr_destroy assumes pointer is not NULL. | ||
12 | |||
13 | So passing NULL pointer to __pthread_attr_destroy will result in | ||
14 | segmentation fault. This scenario is possible if | ||
15 | notification->sigev_notify_attributes == NULL (which means default | ||
16 | thread attributes should be used). | ||
17 | |||
18 | Signed-off-by: Nikita Popov <npv1310@gmail.com> | ||
19 | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> | ||
20 | |||
21 | Upstream-Status: Backport | ||
22 | CVE: CVE-2021-38604 | ||
23 | Signed-off-by: Armin Kuser <akuster@mvista.com> | ||
24 | |||
25 | --- | ||
26 | sysdeps/unix/sysv/linux/mq_notify.c | 2 +- | ||
27 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
28 | |||
29 | Index: git/sysdeps/unix/sysv/linux/mq_notify.c | ||
30 | =================================================================== | ||
31 | --- git.orig/sysdeps/unix/sysv/linux/mq_notify.c | ||
32 | +++ git/sysdeps/unix/sysv/linux/mq_notify.c | ||
33 | @@ -134,7 +134,7 @@ helper_thread (void *arg) | ||
34 | to wait until it is done with it. */ | ||
35 | (void) __pthread_barrier_wait (¬ify_barrier); | ||
36 | } | ||
37 | - else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED) | ||
38 | + else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED && data.attr != NULL) | ||
39 | { | ||
40 | /* The only state we keep is the copy of the thread attributes. */ | ||
41 | pthread_attr_destroy (data.attr); | ||
diff --git a/meta/recipes-core/glibc/glibc_2.31.bb b/meta/recipes-core/glibc/glibc_2.31.bb index 2e950dfeda..3a3586f1b9 100644 --- a/meta/recipes-core/glibc/glibc_2.31.bb +++ b/meta/recipes-core/glibc/glibc_2.31.bb | |||
@@ -69,6 +69,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ | |||
69 | file://CVE-2020-29573.patch \ | 69 | file://CVE-2020-29573.patch \ |
70 | file://CVE-2021-33574_1.patch \ | 70 | file://CVE-2021-33574_1.patch \ |
71 | file://CVE-2021-33574_2.patch \ | 71 | file://CVE-2021-33574_2.patch \ |
72 | file://CVE-2021-38604.patch \ | ||
72 | " | 73 | " |
73 | S = "${WORKDIR}/git" | 74 | S = "${WORKDIR}/git" |
74 | B = "${WORKDIR}/build-${TARGET_SYS}" | 75 | B = "${WORKDIR}/build-${TARGET_SYS}" |