diff --git a/_constraints b/_constraints index f8ea62c..da0a415 100644 --- a/_constraints +++ b/_constraints @@ -6,7 +6,7 @@ - 1500 + 2500 5600 diff --git a/glibc.changes b/glibc.changes index 9212086..8020e50 100644 --- a/glibc.changes +++ b/glibc.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Thu Jun 10 13:24:39 UTC 2021 - Andreas Schwab + +- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify + (CVE-2021-33574, bsc#1186489, BZ #27896) +- Drop glibc-usrmerge-bootstrap-helper package + ------------------------------------------------------------------- Thu May 27 18:05:05 UTC 2021 - Andreas Schwab diff --git a/glibc.spec b/glibc.spec index aa85ab4..82d109f 100644 --- a/glibc.spec +++ b/glibc.spec @@ -180,9 +180,6 @@ Provides: ld-linux.so.3(GLIBC_2.4) Requires(pre): filesystem Recommends: glibc-extra Provides: rtld(GNU_HASH) -%if %{with usrmerged} -Provides: /sbin/ldconfig -%endif %endif %if %{build_utils} Requires: glibc = %{version} @@ -263,6 +260,8 @@ Patch1006: nptl-db-libpthread-load-order.patch Patch1007: rawmemchr-warning.patch # PATCH-FIX-UPSTREAM: x86: tst-cpu-features-supports.c: Update AMX check Patch1008: tst-cpu-features-amx.patch +# PATCH-FIX-UPSTREAM: Use __pthread_attr_copy in mq_notify (CVE-2021-33574, BZ #27896) +Patch1009: mq-notify-use-after-free.patch ### # Patches awaiting upstream approval @@ -447,15 +446,6 @@ are not essential but recommend to use. makedb: A program to create a database for nss -%package usrmerge-bootstrap-helper -Summary: Internal usrmerge bootstrap helper -License: LGPL-2.1-or-later -Requires: glibc = %{version} -Requires: this-is-only-for-build-envs - -%description usrmerge-bootstrap-helper -Internal usrmerge bootstrap helper - %lang_package %endif @@ -489,6 +479,7 @@ Internal usrmerge bootstrap helper %patch1006 -p1 %patch1007 -p1 %patch1008 -p1 +%patch1009 -p1 %patch2000 -p1 %patch2001 -p1 @@ -956,20 +947,6 @@ rm %{buildroot}/%{rtldlib} %endif rm %{buildroot}/sbin -%if %{build_main} -mkdir -p %{buildroot}/%{_lib} -cp %{buildroot}%{slibdir}/libc.so.6 %{buildroot}/%{_lib} -mkdir -p %{buildroot}/%{rtldlib} -cp %{buildroot}%{rtlddir}/%{rtld_name} %{buildroot}/%{rtldlib} -mkdir -p %{buildroot}/sbin -cp %{buildroot}%{rootsbindir}/ldconfig %{buildroot}/sbin -strip %{buildroot}/%{_lib}/libc.so.6 %{buildroot}/%{rtldlib}/%{rtld_name} -strip %{buildroot}/sbin/ldconfig -%ifarch riscv64 -ln -s . %{buildroot}/%{_lib}/lp64d -%endif -%endif - %endif %endif @@ -1292,17 +1269,6 @@ exit 0 %files lang -f libc.lang %endif -%if %{with usrmerged} -%files usrmerge-bootstrap-helper -%defattr(-,root,root) -/sbin/ldconfig -/%{_lib}/libc.so.6 -/%{rtldlib}/%{rtld_name} -%ifarch riscv64 -/%{_lib}/lp64d -%endif -%endif - %endif %if %{build_utils} diff --git a/mq-notify-use-after-free.patch b/mq-notify-use-after-free.patch new file mode 100644 index 0000000..f3df683 --- /dev/null +++ b/mq-notify-use-after-free.patch @@ -0,0 +1,109 @@ +From 42d359350510506b87101cf77202fefcbfc790cb Mon Sep 17 00:00:00 2001 +From: Andreas Schwab +Date: Thu, 27 May 2021 12:49:47 +0200 +Subject: [PATCH 1/2] Use __pthread_attr_copy in mq_notify (bug 27896) + +Make a deep copy of the pthread attribute object to remove a potential +use-after-free issue. + + CVE-2021-33574: The mq_notify function has a potential use-after-free + issue when using a notification type of SIGEV_THREAD and a thread + attribute with a non-default affinity mask. + + +diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c +index cc575a0cdd..f7ddfe5a6c 100644 +--- a/sysdeps/unix/sysv/linux/mq_notify.c ++++ b/sysdeps/unix/sysv/linux/mq_notify.c +@@ -133,8 +133,11 @@ helper_thread (void *arg) + (void) __pthread_barrier_wait (¬ify_barrier); + } + else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED) +- /* The only state we keep is the copy of the thread attributes. */ +- free (data.attr); ++ { ++ /* The only state we keep is the copy of the thread attributes. */ ++ pthread_attr_destroy (data.attr); ++ free (data.attr); ++ } + } + return NULL; + } +@@ -255,8 +258,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification) + if (data.attr == NULL) + return -1; + +- memcpy (data.attr, notification->sigev_notify_attributes, +- sizeof (pthread_attr_t)); ++ __pthread_attr_copy (data.attr, notification->sigev_notify_attributes); + } + + /* Construct the new request. */ +@@ -270,7 +272,10 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification) + + /* If it failed, free the allocated memory. */ + if (__glibc_unlikely (retval != 0)) +- free (data.attr); ++ { ++ pthread_attr_destroy (data.attr); ++ free (data.attr); ++ } + + return retval; + } +-- +2.31.1 + + +From 217b6dc298156bdb0d6aea9ea93e7e394a5ff091 Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Tue, 1 Jun 2021 17:51:41 +0200 +Subject: [PATCH 2/2] Fix use of __pthread_attr_copy in mq_notify (bug 27896) + +__pthread_attr_copy can fail and does not initialize the attribute +structure in that case. + +If __pthread_attr_copy is never called and there is no allocated +attribute, pthread_attr_destroy should not be called, otherwise +there is a null pointer dereference in rt/tst-mqueue6. + +Fixes commit 42d359350510506b87101cf77202fefcbfc790cb +("Use __pthread_attr_copy in mq_notify (bug 27896)"). + +Reviewed-by: Siddhesh Poyarekar +--- + sysdeps/unix/sysv/linux/mq_notify.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c +index f7ddfe5a6c..6f46d29d1d 100644 +--- a/sysdeps/unix/sysv/linux/mq_notify.c ++++ b/sysdeps/unix/sysv/linux/mq_notify.c +@@ -258,7 +258,14 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification) + if (data.attr == NULL) + return -1; + +- __pthread_attr_copy (data.attr, notification->sigev_notify_attributes); ++ int ret = __pthread_attr_copy (data.attr, ++ notification->sigev_notify_attributes); ++ if (ret != 0) ++ { ++ free (data.attr); ++ __set_errno (ret); ++ return -1; ++ } + } + + /* Construct the new request. */ +@@ -271,7 +278,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification) + int retval = INLINE_SYSCALL (mq_notify, 2, mqdes, &se); + + /* If it failed, free the allocated memory. */ +- if (__glibc_unlikely (retval != 0)) ++ if (retval != 0 && data.attr != NULL) + { + pthread_attr_destroy (data.attr); + free (data.attr); +-- +2.31.1 +