diff options
author | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2023-09-19 18:39:32 -0400 |
---|---|---|
committer | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2023-10-02 15:39:10 -0400 |
commit | b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 (patch) | |
tree | 494c4cec20bca9b4a384e43fd609ebd9bae02ed3 /NEWS | |
parent | 2dfd8c77b546fbc46d93a5d71ae319d9c230746b (diff) | |
download | glibc-b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3.tar.gz glibc-b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3.tar.xz glibc-b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3.zip |
tunables: Terminate if end of input is reached (CVE-2023-4911)
The string parsing routine may end up writing beyond bounds of tunestr if the input tunable string is malformed, of the form name=name=val. This gets processed twice, first as name=name=val and next as name=val, resulting in tunestr being name=name=val:name=val, thus overflowing tunestr. Terminate the parsing loop at the first instance itself so that tunestr does not overflow. This also fixes up tst-env-setuid-tunables to actually handle failures correct and add new tests to validate the fix for this CVE. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa)
Diffstat (limited to 'NEWS')
-rw-r--r-- | NEWS | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/NEWS b/NEWS index 3725cc4820..b351537a78 100644 --- a/NEWS +++ b/NEWS @@ -31,6 +31,11 @@ Security related changes: an application calls getaddrinfo for AF_INET6 with AI_CANONNAME, AI_ALL and AI_V4MAPPED flags set. + CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the + environment of a setuid program and NAME is valid, it may result in a + buffer overflow, which could be exploited to achieve escalated + privileges. This flaw was introduced in glibc 2.34. + The following bugs are resolved with this release: [20975] Deferred cancellation triggers in __check_pf and looses lock leading to deadlock |