unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed

blob 106e81d9125ef22f2844f002b0207ba48a618997 959 bytes (raw)
name: gnu/packages/patches/glibc-CVE-2017-1000366.patch 	 # note: path name is non-authoritative(*)

From f6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Mon, 19 Jun 2017 17:09:55 +0200
Subject: [PATCH] CVE-2017-1000366: Ignore LD_LIBRARY_PATH for AT_SECURE=1
 programs [BZ #21624]

LD_LIBRARY_PATH can only be used to reorder system search paths, which
is not useful functionality.

This makes an exploitable unbounded alloca in _dl_init_paths unreachable
for AT_SECURE=1 programs.
---
 ChangeLog  | 7 +++++++
 elf/rtld.c | 3 ++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/elf/rtld.c b/elf/rtld.c
index 2446a87..2269dbe 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -2422,7 +2422,8 @@ process_envvars (enum mode *modep)
 
 	case 12:
 	  /* The library search path.  */
-	  if (memcmp (envline, "LIBRARY_PATH", 12) == 0)
+	  if (!__libc_enable_secure
+	      && memcmp (envline, "LIBRARY_PATH", 12) == 0)
 	    {
 	      library_path = &envline[13];
 	      break;
-- 
2.9.3

debug log:

solving 106e81d91 ...
found 106e81d91 in https://yhetil.org/guix-bugs/20170620071857.GA2768@macbook42.flashner.co.il/

applying [1/1] https://yhetil.org/guix-bugs/20170620071857.GA2768@macbook42.flashner.co.il/
diff --git a/gnu/packages/patches/glibc-CVE-2017-1000366.patch b/gnu/packages/patches/glibc-CVE-2017-1000366.patch
new file mode 100644
index 000000000..106e81d91

1:28: trailing whitespace.
 
1:29: space before tab in indent.
 	case 12:
1:30: space before tab in indent.
 	  /* The library search path.  */
1:34: space before tab in indent.
 	    {
1:35: space before tab in indent.
 	      library_path = &envline[13];
Checking patch gnu/packages/patches/glibc-CVE-2017-1000366.patch...
Applied patch gnu/packages/patches/glibc-CVE-2017-1000366.patch cleanly.
warning: squelched 3 whitespace errors
warning: 8 lines add whitespace errors.

index at:
100644 106e81d9125ef22f2844f002b0207ba48a618997	gnu/packages/patches/glibc-CVE-2017-1000366.patch

(*) Git path names are given by the tree(s) the blob belongs to.
    Blobs themselves have no identifier aside from the hash of its contents.^

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).