glibc: CVE-2017-1000366

glibc contains a vulnerability that allows specially crafted
LD_LIBRARY_PATH values to manipulate the heap/stack, causing
them to alias, potentially resulting in arbitrary code execution.

Reference:
https://security-tracker.debian.org/tracker/CVE-2017-1000366

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Martin Borg <martin.borg@enea.com>

2 files changed, 59 insertions, 0 deletions

diff --git a/recipes-core/glibc/glibc/CVE-2017-1000366.patch b/recipes-core/glibc/glibc/CVE-2017-1000366.patch
new file mode 100644
index 0000000..8ba9c5c
--- /dev/null
+++ b/recipes-core/glibc/glibc/CVE-2017-1000366.patch
@@ -0,0 +1,53 @@
+From f6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Mon, 19 Jun 2017 17:09:55 +0200
+Subject: [PATCH] CVE-2017-1000366: Ignore LD_LIBRARY_PATH for AT_SECURE=1
+ programs [BZ #21624]
+
+LD_LIBRARY_PATH can only be used to reorder system search paths, which
+is not useful functionality.
+
+This makes an exploitable unbounded alloca in _dl_init_paths unreachable
+for AT_SECURE=1 programs.
+
+CVE: CVE-2017-1000366
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=3c7cd21290cabdadd72984fb69bc51e64ff1002d]
+
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ ChangeLog  | 7 +++++++
+ elf/rtld.c | 3 ++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index f140ee6..7bfdf45 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,10 @@
++2017-06-19  Florian Weimer  <fweimer@redhat.com>
++
++       [BZ #21624]
++       CVE-2017-1000366
++       * elf/rtld.c (process_envvars): Ignore LD_LIBRARY_PATH for
++       __libc_enable_secure.
++
+ 2017-02-05  Siddhesh Poyarekar  <siddhesh@sourceware.org>
+ 
+        * version.h (RELEASE): Set to "stable"
+diff --git a/elf/rtld.c b/elf/rtld.c
+index a036ece..2fc33a6 100644
+--- a/elf/rtld.c
++++ b/elf/rtld.c
+@@ -2418,7 +2418,8 @@ process_envvars (enum mode *modep)
+ 
+        case 12:
+          /* The library search path.  */
+-         if (memcmp (envline, "LIBRARY_PATH", 12) == 0)
++         if (!__libc_enable_secure
++             && memcmp (envline, "LIBRARY_PATH", 12) == 0)
+            {
+              library_path = &envline[13];
+              break;
+-- 
+1.9.1
+
diff --git a/recipes-core/glibc/glibc_%.bbappend b/recipes-core/glibc/glibc_%.bbappend
new file mode 100644
index 0000000..1ef0688
--- /dev/null
+++ b/recipes-core/glibc/glibc_%.bbappend
@@ -0,0 +1,6 @@
+# look for files in the layer first
+FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
+
+SRC_URI += "file://CVE-2017-1000366.patch \
+           "
+