CVE-2017-1000376 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000376): libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. This affects libffi version 3.2.1.
commit 6acaa7787fa53d19b19c0f193b24969a5641a315 (HEAD -> master, origin/master, origin/HEAD) Author: Matthias Maier <tamiko@gentoo.org> Date: Wed Jun 21 16:42:23 2017 -0500 dev-libs/libffi: drop old versions, bug #622226 Package-Manager: Portage-2.3.6, Repoman-2.3.2
Do we need a patch for arm64? https://src.fedoraproject.org/cgit/rpms/libffi.git/tree/libffi-3.1-aarch64-fix-exec-stack.patch
According to nvd, last modified 2017-06-28 [1]: It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1. [1] https://nvd.nist.gov/vuln/detail/CVE-2017-1000376 Regards.
@security, will this require a GLSA request/release? Gentoo Security Padawan (jmbailey/mbailey_j)
(In reply to Teika kazura from comment #3) > According to nvd, last modified 2017-06-28 [1]: > > It was previously stated that this affects libffi version 3.2.1 but this > appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems > was vulnerable, and upstream is believed to have fixed this issue in version > 3.1. > > [1] https://nvd.nist.gov/vuln/detail/CVE-2017-1000376 > > Regards. Nothing to do for toolchain here anymore.
(In reply to Teika kazura from comment #3) > According to nvd, last modified 2017-06-28 [1]: > > It was previously stated that this affects libffi version 3.2.1 but this > appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems > was vulnerable, and upstream is believed to have fixed this issue in version > 3.1. > > [1] https://nvd.nist.gov/vuln/detail/CVE-2017-1000376 No, we are looking for commit https://github.com/libffi/libffi/commit/978c9540154d320525488db1b7049277122f736d. And this commit appeared for the first time in libffi-3.2 release. Otherwise, Qualys would have failed to use this flaw in Debian 8 because Debian 8 was already at version 3.1.
Closing this bug as invalid because Gentoo was not affected: Gentoo was already at unaffected >=libffi-3.2.1 version via bug 580616 when this vulnerability got reported.
