From a60ad61f8e43a8cab6a569650cde7e5bb096d3e2 Mon Sep 17 00:00:00 2001 From: xujing Date: Thu, 2 Dec 2021 12:04:19 +0800 Subject: [PATCH] glibc: fix CVE-2019-1010023 (cherry picked from commit 689b5621b0189e9dd2ba1221eff69186f4ff977f) --- backport-glibc-fix-CVE-2019-1010023.patch | 66 +++++++++++++++++++++++ glibc.spec | 6 ++- 2 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 backport-glibc-fix-CVE-2019-1010023.patch diff --git a/backport-glibc-fix-CVE-2019-1010023.patch b/backport-glibc-fix-CVE-2019-1010023.patch new file mode 100644 index 0000000..efa322e --- /dev/null +++ b/backport-glibc-fix-CVE-2019-1010023.patch @@ -0,0 +1,66 @@ +From fe1ffef2eec9c6634a1e9af951eb68f0f5614470 Mon Sep 17 00:00:00 2001 +From: xujing +Date: Thu, 2 Dec 2021 11:41:46 +0800 +Subject: [PATCH] glibc: fix CVE-2019-1010023 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +| PT_LOAD +| +| […] Loadable segment entries in the program header table appear in +| ascending order, sorted on the p_vaddr member. + +http://www.sco.com/developers/gabi/latest/ch5.pheader.html + +Some check needed to fix vulnerability in load commands mapping reported by + +https://sourceware.org/bugzilla/show_bug.cgi?id=22851 + +Signed-off-by: lvying +Signed-off-by: xujing +--- + elf/dl-map-segments.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/elf/dl-map-segments.h b/elf/dl-map-segments.h +index 084076a2..a41ae73b 100644 +--- a/elf/dl-map-segments.h ++++ b/elf/dl-map-segments.h +@@ -33,6 +33,7 @@ _dl_map_segments (struct link_map *l, int fd, + struct link_map *loader) + { + const struct loadcmd *c = loadcmds; ++ ElfW(Addr) l_map_end_aligned; + + if (__glibc_likely (type == ET_DYN)) + { +@@ -61,6 +62,8 @@ _dl_map_segments (struct link_map *l, int fd, + return DL_MAP_SEGMENTS_ERROR_MAP_SEGMENT; + + l->l_map_end = l->l_map_start + maplength; ++ l_map_end_aligned = ((l->l_map_end + GLRO(dl_pagesize) - 1) ++ & ~(GLRO(dl_pagesize) - 1)); + l->l_addr = l->l_map_start - c->mapstart; + + if (has_holes) +@@ -85,10 +88,16 @@ _dl_map_segments (struct link_map *l, int fd, + /* Remember which part of the address space this object uses. */ + l->l_map_start = c->mapstart + l->l_addr; + l->l_map_end = l->l_map_start + maplength; ++ l_map_end_aligned = ((l->l_map_end + GLRO(dl_pagesize) - 1) ++ & ~(GLRO(dl_pagesize) - 1)); + l->l_contiguous = !has_holes; + + while (c < &loadcmds[nloadcmds]) + { ++ if ((l->l_addr + c->mapend) > l_map_end_aligned || ++ (l->l_addr + c->mapstart) < l->l_map_start) ++ return DL_MAP_SEGMENTS_ERROR_MAP_SEGMENT; ++ + if (c->mapend > c->mapstart + /* Map the segment contents from the file. */ + && (__mmap ((void *) (l->l_addr + c->mapstart), +-- +2.23.0 + diff --git a/glibc.spec b/glibc.spec index 564e1a0..b1f9721 100644 --- a/glibc.spec +++ b/glibc.spec @@ -59,7 +59,7 @@ ############################################################################## Name: glibc Version: 2.28 -Release: 80 +Release: 81 Summary: The GNU libc libraries License: %{all_license} URL: http://www.gnu.org/software/glibc/ @@ -139,6 +139,7 @@ Patch55: backport-ldconfig-avoid-leak-on-empty-paths-in-config-file.patch Patch56: backport-rtld-copy-terminating-null-in-tunables_strdup-bug-28.patch Patch57: backport-gconv-Do-not-emit-spurious-NUL-character-in-ISO-2022.patch Patch58: backport-nss-make-sure-startp_initialized-do-first.patch +Patch59: backport-glibc-fix-CVE-2019-1010023.patch Provides: ldconfig rtld(GNU_HASH) bundled(gnulib) @@ -1163,6 +1164,9 @@ fi %doc hesiod/README.hesiod %changelog +* Thu Dec 2 2021 xujing - 2.28-81 +- glibc: fix CVE-2019-1010023 + * Tue Nov 30 2021 chengyechun -2.28-80 - Type: bugfix - CVE: NA -- Gitee