From patchwork Wed Oct 4 19:27:13 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Liliana Marie Prikler X-Patchwork-Id: 54482 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id C4A3527BBE2; Wed, 4 Oct 2023 21:27:08 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FROM,MAILING_LIST_MULTI, SPF_HELO_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id B44D127BBE9 for ; Wed, 4 Oct 2023 21:27:01 +0100 (BST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qo8SD-00046p-PL; Wed, 04 Oct 2023 16:26:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qo8SD-00045v-2L for guix-patches@gnu.org; Wed, 04 Oct 2023 16:26:45 -0400 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qo8SC-0005zy-M5 for guix-patches@gnu.org; Wed, 04 Oct 2023 16:26:44 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1qo8ST-0002qo-U8 for guix-patches@gnu.org; Wed, 04 Oct 2023 16:27:01 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#66348] [PATCH RFC] gnu: glibc: Fix CVE-2023-4911. Resent-From: Liliana Marie Prikler Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Wed, 04 Oct 2023 20:27:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 66348 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 66348@debbugs.gnu.org Cc: Ludovic =?utf-8?q?Court=C3=A8s?= X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.169645116910880 (code B ref -1); Wed, 04 Oct 2023 20:27:01 +0000 Received: (at submit) by debbugs.gnu.org; 4 Oct 2023 20:26:09 +0000 Received: from localhost ([127.0.0.1]:45440 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qo8Rd-0002pQ-1i for submit@debbugs.gnu.org; Wed, 04 Oct 2023 16:26:09 -0400 Received: from lists.gnu.org ([2001:470:142::17]:48920) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qo8Ra-0002on-8Q for submit@debbugs.gnu.org; Wed, 04 Oct 2023 16:26:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qo8RC-0003IZ-6B for guix-patches@gnu.org; Wed, 04 Oct 2023 16:25:42 -0400 Received: from mail-ej1-x642.google.com ([2a00:1450:4864:20::642]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qo8R9-0005ly-PU; Wed, 04 Oct 2023 16:25:41 -0400 Received: by mail-ej1-x642.google.com with SMTP id a640c23a62f3a-9b27bc8b65eso42384766b.0; Wed, 04 Oct 2023 13:25:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1696451134; x=1697055934; darn=gnu.org; h=mime-version:cc:to:subject:date:from:message-id:from:to:cc:subject :date:message-id:reply-to; bh=k/KnvnTjbP+jXOO7ur+FIk5JXBx+ynXq3ljG0kspxuA=; b=RrMrfrUqjaOt/9kauxiSAWui1siJrfrdlurCjcqq4QMnMRadVW0tOarkUCV7X7fC62 3oOHQf4I6TpqantAwIIv+xFhUAHzqDehln2c2ynl3eYzSCw08QGtDPpF51uSkyK6whG9 0WmRUpb92GfnswdjQgnkRhWnavzrg/m42lJOn4mTu6NsQxdVfB6nJxqgw5VT7JeSHpUT crZrIqxWVKkJ4QG0N5y1yF+Ks2tKLnncvbXQpjgA3EKl3JeO+wSwL1ETWip9Y23+PuzB 2geql4dLl1LZoJgVeADup2au0lfEueFNJNS538J8lfYJ45ZcZ4XfE8m7GAszOEB5IRsC JzKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696451134; x=1697055934; h=mime-version:cc:to:subject:date:from:message-id:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=k/KnvnTjbP+jXOO7ur+FIk5JXBx+ynXq3ljG0kspxuA=; b=VvuSPBu9ix2C8EFQeWB76VhIWZuQuOrr8WTFdaczB/EYyNl9478DY5CTf11d3s+/wh QJ42itQAyNtw6EAkb0CwxuEhhbBimvVd25eHf5p2PycFWBnASISkqVVVpbw5+YpeisgD 1gVOeAKN4vWIOXm/GpFMUMSLnLO+MTQvf7MCWbkQ8t3a1ghvE9WbXjI4tB7JPqtiyzHO kOGcvwBZmLeSIj7DqawPPWDXrIEruxIfZudMxQMDjgNumB7wT/xIkCrLkAaVas6+WHcJ NK18lKIqljsTQp6nxDVWIcEpdV3uXiB98wQ9BNasBTSZsgCL1aFcBvyYxlTuQNZKMCag Ri1A== X-Gm-Message-State: AOJu0YzLUlIyyaRs+CrNLSS5HH08+JniU2cqTto39ydKUsRg/4wL5c9P ytAG+8Wstg1iPbXS7aBEmqI7SVYv/yosqA== X-Google-Smtp-Source: AGHT+IGj377do5SANNF66i1dwKFL0uxblEWGWAKClJ48Ww/nwwSFlVZUPPB2HIUD3+vjLoMYBpIzbg== X-Received: by 2002:a17:906:cc49:b0:9a1:b967:aca9 with SMTP id mm9-20020a170906cc4900b009a1b967aca9mr2705568ejb.63.1696451134276; Wed, 04 Oct 2023 13:25:34 -0700 (PDT) Received: from lumine.fritz.box (85-127-52-93.dsl.dynamic.surfer.at. [85.127.52.93]) by smtp.gmail.com with ESMTPSA id g13-20020a170906348d00b0099bd453357esm3325087ejb.41.2023.10.04.13.25.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Oct 2023 13:25:33 -0700 (PDT) Message-ID: From: Liliana Marie Prikler Date: Wed, 4 Oct 2023 21:27:13 +0200 MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::642; envelope-from=liliana.prikler@gmail.com; helo=mail-ej1-x642.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches * gnu/packages/patches/glibc-2.35-CVE-2023-4911.patch: New file. * gnu/local.mk: Register it here. * gnu/packages/base.scm (glibc/fixed): New variable. (glibc): Use it as replacement. --- Hi folks, you might have heard about a little bad boi called CVE-2023-4911. Stirred up some news recently. I've "backported" the fix that's currently sleeping on glibc master to our current glibc; only a test needed adjusting. I still have to verify that it works in a vm, but it appears to be rebuilding more than I anticipated, so that might take me some time. Anyway, have at it in the meantime. Cheers gnu/local.mk | 1 + gnu/packages/base.scm | 10 ++ .../patches/glibc-2.35-CVE-2023-4911.patch | 160 ++++++++++++++++++ 3 files changed, 171 insertions(+) create mode 100644 gnu/packages/patches/glibc-2.35-CVE-2023-4911.patch base-commit: e71864793021051cff35597abd59bb2d5649977d diff --git a/gnu/local.mk b/gnu/local.mk index 83b5268c7e..4a2c635ce6 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1275,6 +1275,7 @@ dist_patch_DATA = \ %D%/packages/patches/glibc-CVE-2019-7309.patch \ %D%/packages/patches/glibc-CVE-2019-9169.patch \ %D%/packages/patches/glibc-CVE-2019-19126.patch \ + %D%/packages/patches/glibc-2.35-CVE-2023-4911.patch \ %D%/packages/patches/glibc-allow-kernel-2.6.32.patch \ %D%/packages/patches/glibc-boot-2.16.0.patch \ %D%/packages/patches/glibc-boot-2.2.5.patch \ diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm index c0813f7de0..2d8e9143cd 100644 --- a/gnu/packages/base.scm +++ b/gnu/packages/base.scm @@ -793,6 +793,7 @@ (define-public glibc (package (name "glibc") (version "2.35") + (replacement glibc/fixed) (source (origin (method url-fetch) (uri (string-append "mirror://gnu/glibc/glibc-" version ".tar.xz")) @@ -1062,6 +1063,15 @@ (define-public glibc (license lgpl2.0+) (home-page "https://www.gnu.org/software/libc/"))) +(define glibc/fixed + (package + (inherit glibc) + (source + (origin (inherit (package-source glibc)) + (patches + (append (search-patches "glibc-2.35-CVE-2023-4911.patch") + (origin-patches (package-source glibc)))))))) + ;; Define a variation of glibc which uses the default /etc/ld.so.cache, useful ;; in FHS containers. (define-public glibc-for-fhs diff --git a/gnu/packages/patches/glibc-2.35-CVE-2023-4911.patch b/gnu/packages/patches/glibc-2.35-CVE-2023-4911.patch new file mode 100644 index 0000000000..d8044f064d --- /dev/null +++ b/gnu/packages/patches/glibc-2.35-CVE-2023-4911.patch @@ -0,0 +1,160 @@ +From 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa Mon Sep 17 00:00:00 2001 +From: Siddhesh Poyarekar +Date: Tue, 19 Sep 2023 18:39:32 -0400 +Subject: [PATCH 1/1] tunables: Terminate if end of input is reached + (CVE-2023-4911) + +The string parsing routine may end up writing beyond bounds of tunestr +if the input tunable string is malformed, of the form name=name=val. +This gets processed twice, first as name=name=val and next as name=val, +resulting in tunestr being name=name=val:name=val, thus overflowing +tunestr. + +Terminate the parsing loop at the first instance itself so that tunestr +does not overflow. + +This also fixes up tst-env-setuid-tunables to actually handle failures +correct and add new tests to validate the fix for this CVE. + +Signed-off-by: Siddhesh Poyarekar +Reviewed-by: Carlos O'Donell +--- +Backported to 2.35 by Liliana Marie Prikler + + NEWS | 5 +++++ + elf/dl-tunables.c | 17 +++++++++------- + elf/tst-env-setuid-tunables.c | 37 +++++++++++++++++++++++++++-------- + 3 files changed, 44 insertions(+), 15 deletions(-) + +Index: glibc-2.35/NEWS +=================================================================== +--- glibc-2.35.orig/NEWS ++++ glibc-2.35/NEWS +@@ -199,6 +199,11 @@ Security related changes: + corresponds to the / directory through an unprivileged mount + namespace. Reported by Qualys. + ++ CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the ++ environment of a setuid program and NAME is valid, it may result in a ++ buffer overflow, which could be exploited to achieve escalated ++ privileges. This flaw was introduced in glibc 2.34. ++ + The following bugs are resolved with this release: + + [12889] nptl: Race condition in pthread_kill +Index: glibc-2.35/elf/dl-tunables.c +=================================================================== +--- glibc-2.35.orig/elf/dl-tunables.c ++++ glibc-2.35/elf/dl-tunables.c +@@ -187,11 +187,7 @@ parse_tunables (char *tunestr, char *val + /* If we reach the end of the string before getting a valid name-value + pair, bail out. */ + if (p[len] == '\0') +- { +- if (__libc_enable_secure) +- tunestr[off] = '\0'; +- return; +- } ++ break; + + /* We did not find a valid name-value pair before encountering the + colon. */ +@@ -251,9 +247,16 @@ parse_tunables (char *tunestr, char *val + } + } + +- if (p[len] != '\0') +- p += len + 1; ++ /* We reached the end while processing the tunable string. */ ++ if (p[len] == '\0') ++ break; ++ ++ p += len + 1; + } ++ ++ /* Terminate tunestr before we leave. */ ++ if (__libc_enable_secure) ++ tunestr[off] = '\0'; + } + #endif + +Index: glibc-2.35/elf/tst-env-setuid-tunables.c +=================================================================== +--- glibc-2.35.orig/elf/tst-env-setuid-tunables.c ++++ glibc-2.35/elf/tst-env-setuid-tunables.c +@@ -52,6 +52,8 @@ const char *teststrings[] = + "glibc.malloc.perturb=0x800:not_valid.malloc.check=2:glibc.malloc.mmap_threshold=4096", + "glibc.not_valid.check=2:glibc.malloc.mmap_threshold=4096", + "not_valid.malloc.check=2:glibc.malloc.mmap_threshold=4096", ++ "glibc.malloc.mmap_threshold=glibc.malloc.mmap_threshold=4096", ++ "glibc.malloc.check=2", + "glibc.malloc.garbage=2:glibc.maoc.mmap_threshold=4096:glibc.malloc.check=2", + "glibc.malloc.check=4:glibc.malloc.garbage=2:glibc.maoc.mmap_threshold=4096", + ":glibc.malloc.garbage=2:glibc.malloc.check=1", +@@ -70,6 +72,8 @@ const char *resultstrings[] = + "glibc.malloc.perturb=0x800:glibc.malloc.mmap_threshold=4096", + "glibc.malloc.mmap_threshold=4096", + "glibc.malloc.mmap_threshold=4096", ++ "glibc.malloc.mmap_threshold=glibc.malloc.mmap_threshold=4096", ++ "", + "", + "", + "", +@@ -89,6 +93,8 @@ test_child (int off) + + if (val != NULL) + printf ("[%d] Unexpected GLIBC_TUNABLES VALUE %s\n", off, val); ++ else ++ printf ("[%d] GLIBC_TUNABLES environment variable absent\n", off); + + return 1; + #else +@@ -117,21 +123,26 @@ do_test (int argc, char **argv) + if (ret != 0) + exit (1); + +- exit (EXIT_SUCCESS); ++ /* Special return code to make sure that the child executed all the way ++ through. */ ++ exit (42); + } + else + { +- int ret = 0; +- + /* Spawn tests. */ + for (int i = 0; i < array_length (teststrings); i++) + { + char buf[INT_BUFSIZE_BOUND (int)]; + +- printf ("Spawned test for %s (%d)\n", teststrings[i], i); ++ printf ("[%d] Spawned test for %s\n", i, teststrings[i]); + snprintf (buf, sizeof (buf), "%d\n", i); ++ fflush (stdout); + if (setenv ("GLIBC_TUNABLES", teststrings[i], 1) != 0) +- exit (1); ++ { ++ printf (" [%d] Failed to set GLIBC_TUNABLES: %m", i); ++ support_record_failure (); ++ continue; ++ } + + int status = support_capture_subprogram_self_sgid (buf); + +@@ -139,9 +150,14 @@ do_test (int argc, char **argv) + if (WEXITSTATUS (status) == EXIT_UNSUPPORTED) + return EXIT_UNSUPPORTED; + +- ret |= status; ++ if (WEXITSTATUS (status) != 42) ++ { ++ printf (" [%d] child failed with status %d\n", i, ++ WEXITSTATUS (status)); ++ support_record_failure (); ++ } + } +- return ret; ++ return 0; + } + } +