From 554cdda90f044c6312f254d4d95f21a00833c4e6ff740a620ca3c22c70498b52 Mon Sep 17 00:00:00 2001
From: Andreas Schwab <schwab@suse.de>
Date: Mon, 9 Dec 2019 16:42:30 +0000
Subject: [PATCH] Accepting request 755338 from home:Andreas_Schwab:Factory

- prefer-map-32bit-exec.patch: rtld: Check __libc_enable_secure before
  honoring LD_PREFER_MAP_32BIT_EXEC (CVE-2019-19126, bsc#1157292, BZ
  #25204)

OBS-URL: https://build.opensuse.org/request/show/755338
OBS-URL: https://build.opensuse.org/package/show/Base:System/glibc?expand=0&rev=546
---
 glibc.changes               |  7 +++++++
 glibc.spec                  |  3 +++
 prefer-map-32bit-exec.patch | 28 ++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+)
 create mode 100644 prefer-map-32bit-exec.patch

diff --git a/glibc.changes b/glibc.changes
index bb50974..2e59174 100644
--- a/glibc.changes
+++ b/glibc.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Dec  9 13:21:34 UTC 2019 - Andreas Schwab <schwab@suse.de>
+
+- prefer-map-32bit-exec.patch: rtld: Check __libc_enable_secure before
+  honoring LD_PREFER_MAP_32BIT_EXEC (CVE-2019-19126, bsc#1157292, BZ
+  #25204)
+
 -------------------------------------------------------------------
 Tue Nov 26 11:34:45 CET 2019 - kukuk@suse.de
 
diff --git a/glibc.spec b/glibc.spec
index 421d285..fa10f98 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -261,6 +261,8 @@ Patch306:       glibc-fix-double-loopback.diff
 Patch1000:      malloc-info-whitespace.patch
 # PATCH-FIX-UPSTREAM Fix RISC-V vfork build with Linux 5.3 kernel headers
 Patch1001:      riscv-vfork.patch
+# PATCH-FIX-UPSTREAM rtld: Check __libc_enable_secure before honoring LD_PREFER_MAP_32BIT_EXEC (CVE-2019-19126, BZ #25204)
+Patch1002:      prefer-map-32bit-exec.patch
 
 ### 
 # Patches awaiting upstream approval
@@ -472,6 +474,7 @@ makedb: A program to create a database for nss
 
 %patch1000 -p1
 %patch1001 -p1
+%patch1002 -p1
 
 %patch2000 -p1
 %patch2001 -p1
diff --git a/prefer-map-32bit-exec.patch b/prefer-map-32bit-exec.patch
new file mode 100644
index 0000000..1f85cd3
--- /dev/null
+++ b/prefer-map-32bit-exec.patch
@@ -0,0 +1,28 @@
+From d5dfad4326fc683c813df1e37bbf5cf920591c8e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marcin=20Ko=C5=9Bcielnicki?= <mwk@0x04.net>
+Date: Thu, 21 Nov 2019 00:20:15 +0100
+Subject: [PATCH] rtld: Check __libc_enable_secure before honoring
+ LD_PREFER_MAP_32BIT_EXEC (CVE-2019-19126) [BZ #25204]
+
+The problem was introduced in glibc 2.23, in commit
+b9eb92ab05204df772eb4929eccd018637c9f3e9
+("Add Prefer_MAP_32BIT_EXEC to map executable pages with MAP_32BIT").
+---
+ NEWS                                            | 6 +++++-
+ sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h | 3 ++-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+Index: glibc-2.30/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
+===================================================================
+--- glibc-2.30.orig/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
++++ glibc-2.30/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
+@@ -31,7 +31,8 @@
+    environment variable, LD_PREFER_MAP_32BIT_EXEC.  */
+ #define EXTRA_LD_ENVVARS \
+   case 21:								  \
+-    if (memcmp (envline, "PREFER_MAP_32BIT_EXEC", 21) == 0)		  \
++    if (!__libc_enable_secure						  \
++	&& memcmp (envline, "PREFER_MAP_32BIT_EXEC", 21) == 0)		  \
+       GLRO(dl_x86_cpu_features).feature[index_arch_Prefer_MAP_32BIT_EXEC] \
+ 	|= bit_arch_Prefer_MAP_32BIT_EXEC;				  \
+     break;