rpm/glibc
SHA256
1
0
Fork 0
forked from pool/glibc
Code Pull Requests Activity

Accepting request 899090 from home:Andreas_Schwab:Factory

Browse Source 
- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)
- Drop glibc-usrmerge-bootstrap-helper package

OBS-URL: https://build.opensuse.org/request/show/899090
OBS-URL: https://build.opensuse.org/package/show/Base:System/glibc?expand=0&rev=597
This commit is contained in:
Andreas Schwab 2021-06-10 16:46:48 +00:00 committed by Git OBS Bridge
parent cdefcafa37
commit 75f810d685
4 changed files with 120 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
_constraints
View File

@ -6,7 +6,7 @@
</conditions>
<hardware>
<memory>
<size unit="M">1500</size>
<size unit="M">2500</size>
</memory>
<disk>
<size unit="M">5600</size>

7
glibc.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Thu Jun 10 13:24:39 UTC 2021 - Andreas Schwab <schwab@suse.de>
- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
(CVE-2021-33574, bsc#1186489, BZ #27896)
- Drop glibc-usrmerge-bootstrap-helper package
-------------------------------------------------------------------
Thu May 27 18:05:05 UTC 2021 - Andreas Schwab <schwab@suse.de>

40
glibc.spec
View File

@ -180,9 +180,6 @@ Provides: ld-linux.so.3(GLIBC_2.4)
Requires(pre): filesystem
Recommends: glibc-extra
Provides: rtld(GNU_HASH)
%if %{with usrmerged}
Provides: /sbin/ldconfig
%endif
%endif
%if %{build_utils}
Requires: glibc = %{version}
@ -263,6 +260,8 @@ Patch1006: nptl-db-libpthread-load-order.patch
Patch1007: rawmemchr-warning.patch
# PATCH-FIX-UPSTREAM: x86: tst-cpu-features-supports.c: Update AMX check
Patch1008: tst-cpu-features-amx.patch
# PATCH-FIX-UPSTREAM: Use __pthread_attr_copy in mq_notify (CVE-2021-33574, BZ #27896)
Patch1009: mq-notify-use-after-free.patch
###
# Patches awaiting upstream approval
@ -447,15 +446,6 @@ are not essential but recommend to use.
makedb: A program to create a database for nss
%package usrmerge-bootstrap-helper
Summary: Internal usrmerge bootstrap helper
License: LGPL-2.1-or-later
Requires: glibc = %{version}
Requires: this-is-only-for-build-envs
%description usrmerge-bootstrap-helper
Internal usrmerge bootstrap helper
%lang_package
%endif
@ -489,6 +479,7 @@ Internal usrmerge bootstrap helper
%patch1006 -p1
%patch1007 -p1
%patch1008 -p1
%patch1009 -p1
%patch2000 -p1
%patch2001 -p1
@ -956,20 +947,6 @@ rm %{buildroot}/%{rtldlib}
%endif
rm %{buildroot}/sbin
%if %{build_main}
mkdir -p %{buildroot}/%{_lib}
cp %{buildroot}%{slibdir}/libc.so.6 %{buildroot}/%{_lib}
mkdir -p %{buildroot}/%{rtldlib}
cp %{buildroot}%{rtlddir}/%{rtld_name} %{buildroot}/%{rtldlib}
mkdir -p %{buildroot}/sbin
cp %{buildroot}%{rootsbindir}/ldconfig %{buildroot}/sbin
strip %{buildroot}/%{_lib}/libc.so.6 %{buildroot}/%{rtldlib}/%{rtld_name}
strip %{buildroot}/sbin/ldconfig
%ifarch riscv64
ln -s . %{buildroot}/%{_lib}/lp64d
%endif
%endif
%endif
%endif
@ -1292,17 +1269,6 @@ exit 0
%files lang -f libc.lang
%endif
%if %{with usrmerged}
%files usrmerge-bootstrap-helper
%defattr(-,root,root)
/sbin/ldconfig
/%{_lib}/libc.so.6
/%{rtldlib}/%{rtld_name}
%ifarch riscv64
/%{_lib}/lp64d
%endif
%endif
%endif
%if %{build_utils}

109
mq-notify-use-after-free.patch Normal file
View File

@ -0,0 +1,109 @@
From 42d359350510506b87101cf77202fefcbfc790cb Mon Sep 17 00:00:00 2001
From: Andreas Schwab <schwab@linux-m68k.org>
Date: Thu, 27 May 2021 12:49:47 +0200
Subject: [PATCH 1/2] Use __pthread_attr_copy in mq_notify (bug 27896)
Make a deep copy of the pthread attribute object to remove a potential
use-after-free issue.
CVE-2021-33574: The mq_notify function has a potential use-after-free
issue when using a notification type of SIGEV_THREAD and a thread
attribute with a non-default affinity mask.
diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c
index cc575a0cdd..f7ddfe5a6c 100644
--- a/sysdeps/unix/sysv/linux/mq_notify.c
+++ b/sysdeps/unix/sysv/linux/mq_notify.c
@@ -133,8 +133,11 @@ helper_thread (void *arg)
(void) __pthread_barrier_wait (&notify_barrier);
}
else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED)
- /* The only state we keep is the copy of the thread attributes. */
- free (data.attr);
+ {
+ /* The only state we keep is the copy of the thread attributes. */
+ pthread_attr_destroy (data.attr);
+ free (data.attr);
+ }
}
return NULL;
}
@@ -255,8 +258,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
if (data.attr == NULL)
return -1;
- memcpy (data.attr, notification->sigev_notify_attributes,
- sizeof (pthread_attr_t));
+ __pthread_attr_copy (data.attr, notification->sigev_notify_attributes);
}
/* Construct the new request. */
@@ -270,7 +272,10 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
/* If it failed, free the allocated memory. */
if (__glibc_unlikely (retval != 0))
- free (data.attr);
+ {
+ pthread_attr_destroy (data.attr);
+ free (data.attr);
+ }
return retval;
}
--
2.31.1
From 217b6dc298156bdb0d6aea9ea93e7e394a5ff091 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Tue, 1 Jun 2021 17:51:41 +0200
Subject: [PATCH 2/2] Fix use of __pthread_attr_copy in mq_notify (bug 27896)
__pthread_attr_copy can fail and does not initialize the attribute
structure in that case.
If __pthread_attr_copy is never called and there is no allocated
attribute, pthread_attr_destroy should not be called, otherwise
there is a null pointer dereference in rt/tst-mqueue6.
Fixes commit 42d359350510506b87101cf77202fefcbfc790cb
("Use __pthread_attr_copy in mq_notify (bug 27896)").
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
---
sysdeps/unix/sysv/linux/mq_notify.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c
index f7ddfe5a6c..6f46d29d1d 100644
--- a/sysdeps/unix/sysv/linux/mq_notify.c
+++ b/sysdeps/unix/sysv/linux/mq_notify.c
@@ -258,7 +258,14 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
if (data.attr == NULL)
return -1;
- __pthread_attr_copy (data.attr, notification->sigev_notify_attributes);
+ int ret = __pthread_attr_copy (data.attr,
+ notification->sigev_notify_attributes);
+ if (ret != 0)
+ {
+ free (data.attr);
+ __set_errno (ret);
+ return -1;
+ }
}
/* Construct the new request. */
@@ -271,7 +278,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
int retval = INLINE_SYSCALL (mq_notify, 2, mqdes, &se);
/* If it failed, free the allocated memory. */
- if (__glibc_unlikely (retval != 0))
+ if (retval != 0 && data.attr != NULL)
{
pthread_attr_destroy (data.attr);
free (data.attr);
--
2.31.1