Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 353589 (CVE-2010-3192) - sys-libs/glibc: __fortify_fail may use corrupted memory when called from SSP callback (CVE-2010-3192)
Summary: sys-libs/glibc: __fortify_fail may use corrupted memory when called from SSP ...
Alias: CVE-2010-3192
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
Whiteboard: A4? [upstream]
Depends on:
Reported: 2011-02-03 07:12 UTC by Paweł Hajdan, Jr. (RETIRED)
Modified: 2011-02-05 08:46 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-02-03 07:12:57 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-3192 to
the following vulnerability:

Certain run-time memory protection mechanisms in the GNU C Library
(aka glibc or libc6) print argv[0] and backtrace information, which
might allow context-dependent attackers to obtain sensitive
information from process memory by executing an incorrect program, as
demonstrated by a setuid program that contains a stack-based buffer
overflow error, related to the __fortify_fail function in
debug/fortify_fail.c, and the __stack_chk_fail (aka stack protection)
and __chk_fail (aka FORTIFY_SOURCE) implementations.

Comment 1 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-02-04 21:01:58 UTC
Upstream bug closed WONTFIX:
Comment 2 SpanKY gentoo-dev 2011-02-05 08:46:43 UTC
Gentoo has long been replacing the stack chk handler with its own implementation that goes out of its way to use syscalls directly and not C lib funcs.  it also does not call backtrace() which is mostly what the CVE complains about.  as for argv[0], bite me ... `ps` can usually give you the same thing.  so that part of the report is INVALID for Gentoo's shipping glibc.

fortify failures do still print out a backtrace, but those checks occur before the actual functions are executed, so the backtrace output shouldnt be operating on corrupted memory.  on the off chance it does, consider this a WONTFIX -- the output is useful to people, and upstream isnt changing it.