forked from pool/glibc
Accepting request 899090 from home:Andreas_Schwab:Factory
- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify (CVE-2021-33574, bsc#1186489, BZ #27896) - Drop glibc-usrmerge-bootstrap-helper package OBS-URL: https://build.opensuse.org/request/show/899090 OBS-URL: https://build.opensuse.org/package/show/Base:System/glibc?expand=0&rev=597
This commit is contained in:
Andreas Schwab
Git OBS Bridge
parent
cdefcafa37
commit
75f810d685
@ -6,7 +6,7 @@
|
||||
</conditions>
|
||||
<hardware>
|
||||
<memory>
|
||||
<size unit="M">1500</size>
|
||||
<size unit="M">2500</size>
|
||||
</memory>
|
||||
<disk>
|
||||
<size unit="M">5600</size>
|
||||
|
||||
@ -1,3 +1,10 @@
|
||||
-------------------------------------------------------------------
|
||||
Thu Jun 10 13:24:39 UTC 2021 - Andreas Schwab <schwab@suse.de>
|
||||
|
||||
- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
|
||||
(CVE-2021-33574, bsc#1186489, BZ #27896)
|
||||
- Drop glibc-usrmerge-bootstrap-helper package
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu May 27 18:05:05 UTC 2021 - Andreas Schwab <schwab@suse.de>
|
||||
|
||||
|
||||
40
glibc.spec
40
glibc.spec
@ -180,9 +180,6 @@ Provides: ld-linux.so.3(GLIBC_2.4)
|
||||
Requires(pre): filesystem
|
||||
Recommends: glibc-extra
|
||||
Provides: rtld(GNU_HASH)
|
||||
%if %{with usrmerged}
|
||||
Provides: /sbin/ldconfig
|
||||
%endif
|
||||
%endif
|
||||
%if %{build_utils}
|
||||
Requires: glibc = %{version}
|
||||
@ -263,6 +260,8 @@ Patch1006: nptl-db-libpthread-load-order.patch
|
||||
Patch1007: rawmemchr-warning.patch
|
||||
# PATCH-FIX-UPSTREAM: x86: tst-cpu-features-supports.c: Update AMX check
|
||||
Patch1008: tst-cpu-features-amx.patch
|
||||
# PATCH-FIX-UPSTREAM: Use __pthread_attr_copy in mq_notify (CVE-2021-33574, BZ #27896)
|
||||
Patch1009: mq-notify-use-after-free.patch
|
||||
|
||||
###
|
||||
# Patches awaiting upstream approval
|
||||
@ -447,15 +446,6 @@ are not essential but recommend to use.
|
||||
|
||||
makedb: A program to create a database for nss
|
||||
|
||||
%package usrmerge-bootstrap-helper
|
||||
Summary: Internal usrmerge bootstrap helper
|
||||
License: LGPL-2.1-or-later
|
||||
Requires: glibc = %{version}
|
||||
Requires: this-is-only-for-build-envs
|
||||
|
||||
%description usrmerge-bootstrap-helper
|
||||
Internal usrmerge bootstrap helper
|
||||
|
||||
%lang_package
|
||||
%endif
|
||||
|
||||
@ -489,6 +479,7 @@ Internal usrmerge bootstrap helper
|
||||
%patch1006 -p1
|
||||
%patch1007 -p1
|
||||
%patch1008 -p1
|
||||
%patch1009 -p1
|
||||
|
||||
%patch2000 -p1
|
||||
%patch2001 -p1
|
||||
@ -956,20 +947,6 @@ rm %{buildroot}/%{rtldlib}
|
||||
%endif
|
||||
rm %{buildroot}/sbin
|
||||
|
||||
%if %{build_main}
|
||||
mkdir -p %{buildroot}/%{_lib}
|
||||
cp %{buildroot}%{slibdir}/libc.so.6 %{buildroot}/%{_lib}
|
||||
mkdir -p %{buildroot}/%{rtldlib}
|
||||
cp %{buildroot}%{rtlddir}/%{rtld_name} %{buildroot}/%{rtldlib}
|
||||
mkdir -p %{buildroot}/sbin
|
||||
cp %{buildroot}%{rootsbindir}/ldconfig %{buildroot}/sbin
|
||||
strip %{buildroot}/%{_lib}/libc.so.6 %{buildroot}/%{rtldlib}/%{rtld_name}
|
||||
strip %{buildroot}/sbin/ldconfig
|
||||
%ifarch riscv64
|
||||
ln -s . %{buildroot}/%{_lib}/lp64d
|
||||
%endif
|
||||
%endif
|
||||
|
||||
%endif
|
||||
|
||||
%endif
|
||||
@ -1292,17 +1269,6 @@ exit 0
|
||||
%files lang -f libc.lang
|
||||
%endif
|
||||
|
||||
%if %{with usrmerged}
|
||||
%files usrmerge-bootstrap-helper
|
||||
%defattr(-,root,root)
|
||||
/sbin/ldconfig
|
||||
/%{_lib}/libc.so.6
|
||||
/%{rtldlib}/%{rtld_name}
|
||||
%ifarch riscv64
|
||||
/%{_lib}/lp64d
|
||||
%endif
|
||||
%endif
|
||||
|
||||
%endif
|
||||
|
||||
%if %{build_utils}
|
||||
|
||||
109
mq-notify-use-after-free.patch
Normal file
109
mq-notify-use-after-free.patch
Normal file
@ -0,0 +1,109 @@
|
||||
From 42d359350510506b87101cf77202fefcbfc790cb Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schwab <schwab@linux-m68k.org>
|
||||
Date: Thu, 27 May 2021 12:49:47 +0200
|
||||
Subject: [PATCH 1/2] Use __pthread_attr_copy in mq_notify (bug 27896)
|
||||
|
||||
Make a deep copy of the pthread attribute object to remove a potential
|
||||
use-after-free issue.
|
||||
|
||||
CVE-2021-33574: The mq_notify function has a potential use-after-free
|
||||
issue when using a notification type of SIGEV_THREAD and a thread
|
||||
attribute with a non-default affinity mask.
|
||||
|
||||
|
||||
diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c
|
||||
index cc575a0cdd..f7ddfe5a6c 100644
|
||||
--- a/sysdeps/unix/sysv/linux/mq_notify.c
|
||||
+++ b/sysdeps/unix/sysv/linux/mq_notify.c
|
||||
@@ -133,8 +133,11 @@ helper_thread (void *arg)
|
||||
(void) __pthread_barrier_wait (¬ify_barrier);
|
||||
}
|
||||
else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED)
|
||||
- /* The only state we keep is the copy of the thread attributes. */
|
||||
- free (data.attr);
|
||||
+ {
|
||||
+ /* The only state we keep is the copy of the thread attributes. */
|
||||
+ pthread_attr_destroy (data.attr);
|
||||
+ free (data.attr);
|
||||
+ }
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
@@ -255,8 +258,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
|
||||
if (data.attr == NULL)
|
||||
return -1;
|
||||
|
||||
- memcpy (data.attr, notification->sigev_notify_attributes,
|
||||
- sizeof (pthread_attr_t));
|
||||
+ __pthread_attr_copy (data.attr, notification->sigev_notify_attributes);
|
||||
}
|
||||
|
||||
/* Construct the new request. */
|
||||
@@ -270,7 +272,10 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
|
||||
|
||||
/* If it failed, free the allocated memory. */
|
||||
if (__glibc_unlikely (retval != 0))
|
||||
- free (data.attr);
|
||||
+ {
|
||||
+ pthread_attr_destroy (data.attr);
|
||||
+ free (data.attr);
|
||||
+ }
|
||||
|
||||
return retval;
|
||||
}
|
||||
--
|
||||
2.31.1
|
||||
|
||||
|
||||
From 217b6dc298156bdb0d6aea9ea93e7e394a5ff091 Mon Sep 17 00:00:00 2001
|
||||
From: Florian Weimer <fweimer@redhat.com>
|
||||
Date: Tue, 1 Jun 2021 17:51:41 +0200
|
||||
Subject: [PATCH 2/2] Fix use of __pthread_attr_copy in mq_notify (bug 27896)
|
||||
|
||||
__pthread_attr_copy can fail and does not initialize the attribute
|
||||
structure in that case.
|
||||
|
||||
If __pthread_attr_copy is never called and there is no allocated
|
||||
attribute, pthread_attr_destroy should not be called, otherwise
|
||||
there is a null pointer dereference in rt/tst-mqueue6.
|
||||
|
||||
Fixes commit 42d359350510506b87101cf77202fefcbfc790cb
|
||||
("Use __pthread_attr_copy in mq_notify (bug 27896)").
|
||||
|
||||
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
||||
---
|
||||
sysdeps/unix/sysv/linux/mq_notify.c | 11 +++++++++--
|
||||
1 file changed, 9 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c
|
||||
index f7ddfe5a6c..6f46d29d1d 100644
|
||||
--- a/sysdeps/unix/sysv/linux/mq_notify.c
|
||||
+++ b/sysdeps/unix/sysv/linux/mq_notify.c
|
||||
@@ -258,7 +258,14 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
|
||||
if (data.attr == NULL)
|
||||
return -1;
|
||||
|
||||
- __pthread_attr_copy (data.attr, notification->sigev_notify_attributes);
|
||||
+ int ret = __pthread_attr_copy (data.attr,
|
||||
+ notification->sigev_notify_attributes);
|
||||
+ if (ret != 0)
|
||||
+ {
|
||||
+ free (data.attr);
|
||||
+ __set_errno (ret);
|
||||
+ return -1;
|
||||
+ }
|
||||
}
|
||||
|
||||
/* Construct the new request. */
|
||||
@@ -271,7 +278,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
|
||||
int retval = INLINE_SYSCALL (mq_notify, 2, mqdes, &se);
|
||||
|
||||
/* If it failed, free the allocated memory. */
|
||||
- if (__glibc_unlikely (retval != 0))
|
||||
+ if (retval != 0 && data.attr != NULL)
|
||||
{
|
||||
pthread_attr_destroy (data.attr);
|
||||
free (data.attr);
|
||||
--
|
||||
2.31.1
|
||||
|
||||
Loading…
Reference in New Issue
Block a user