Bug 183844 - sys-libs/glibc: integer overflow in ld.so CVE-2007-3508
|
Bug#:
183844
|
Product: Gentoo Security
|
Version: unspecified
|
Platform: All
|
|
OS/Version: Linux
|
Status: RESOLVED
|
Severity: major
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: taviso@gentoo.org
|
|
Component: Vulnerabilities
|
|
|
URL:
|
|
Summary: sys-libs/glibc: integer overflow in ld.so CVE-2007-3508
|
|
Keywords:
|
|
Status Whiteboard: A1 [glsa]
|
|
Opened: 2007-07-01 15:29 0000
|
When there are many bits set in LD_HWCAP_MASK, an integer overflow could result
in too little memory being allocated, potentially resulting in an exploitable
condition.
Reproduce:
$ env -i LD_HWCAP_MASK=$((0xffffffff)) su
$ strace -emmap2 -f env -i LD_HWCAP_MASK=$((0x7fffffff)) su
As hwcap_mask is honoured for suid binaries, this is a security issue. Attached
patch disabled this, as some other distributions have already done (eg, Owl).
Vapier, could you prepare an updated ebuild incorporating this patch? Please
dont commit it to portage yet, as this issue may require an embargo.
This is in the tree now as -r4 per a taviso request.
solar@hangover / $ LD_HWCAP_MASK=$((0xffffffff)) id
Inconsistency detected by ld.so: dl-minimal.c: 84: __libc_memalign: Assertion
`page != ((void *) -1)' failed!
solar@hangover / $ LD_HWCAP_MASK=$((0xffffffff)) su
Password:
http://sources.gentoo.org/viewcvs.py/gentoo/src/patchsets/glibc/2.5/ as patch
1600
x86: Please test and mark stable sys-libs/glibc-2.5-r4, in particular, please
ensure that the following command succeeds:
$ env -i LD_HWCAP_MASK=$((0xffffffff)) su
x86 stable, changing status to glsa?
Shouldn't amd64 be marking this stable too before you do the glsa...
Is there any chance of having a 2.3 and 2.4 version of Glibc made available for
this - some binary packages (HelixServer for instance) have problems with some
versions of glibc, and if you have to run them, it'd be nice to be able to run
them on a secure version of glibc.
Jeremy: we believe only x86 is affected, a 64bit arch like amd64 should be safe
Calum: This only affects suid applications, so unless your server is setuid,
this shouldnt affect you
Aaah, thanks for the reply.
Doesn't it mean though that someone could use a "standard" suid program such as
su/mount/passwd to gain root though?
what's the upstream status ? has anyone posted there ? if not, i'll take it
up
ok, i checked for the mask rather than the fix ... i'll update our patches to
match upstream ... thanks
considering all arches parse glsa's, i think all should stabilize ...
especially since it's pretty trivial/non-invasive
reopening bug, so this pops up in bug lists of stable marking monkeys ^^
(In reply to comment #8)
> Jeremy: we believe only x86 is affected, a 64bit arch like amd64 should be safe
32bit suid apps on amd64 are affected though...
$ env -i LD_HWCAP_MASK=$((0xffffffff)) /mnt/gentoo32/bin/su
Segmentation fault
Any reason this is still open?
