diff options
author | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2023-09-19 18:39:32 -0400 |
---|---|---|
committer | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2023-10-02 15:44:25 -0400 |
commit | dcc367f148bc92e7f3778a125f7a416b093964d9 (patch) | |
tree | c584b417d7999c8701cc154de33bad1975d39d62 /elf/dl-tunables.c | |
parent | c3b99f8328939533a9b6ac93e8ae7285e90fbdab (diff) | |
download | glibc-dcc367f148bc92e7f3778a125f7a416b093964d9.tar.gz glibc-dcc367f148bc92e7f3778a125f7a416b093964d9.tar.xz glibc-dcc367f148bc92e7f3778a125f7a416b093964d9.zip |
tunables: Terminate if end of input is reached (CVE-2023-4911)
The string parsing routine may end up writing beyond bounds of tunestr if the input tunable string is malformed, of the form name=name=val. This gets processed twice, first as name=name=val and next as name=val, resulting in tunestr being name=name=val:name=val, thus overflowing tunestr. Terminate the parsing loop at the first instance itself so that tunestr does not overflow. This also fixes up tst-env-setuid-tunables to actually handle failures correct and add new tests to validate the fix for this CVE. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa)
Diffstat (limited to 'elf/dl-tunables.c')
-rw-r--r-- | elf/dl-tunables.c | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c index 8009e54ee5..837474b504 100644 --- a/elf/dl-tunables.c +++ b/elf/dl-tunables.c @@ -188,11 +188,7 @@ parse_tunables (char *tunestr, char *valstring) /* If we reach the end of the string before getting a valid name-value pair, bail out. */ if (p[len] == '\0') - { - if (__libc_enable_secure) - tunestr[off] = '\0'; - return; - } + break; /* We did not find a valid name-value pair before encountering the colon. */ @@ -252,9 +248,16 @@ parse_tunables (char *tunestr, char *valstring) } } - if (p[len] != '\0') - p += len + 1; + /* We reached the end while processing the tunable string. */ + if (p[len] == '\0') + break; + + p += len + 1; } + + /* Terminate tunestr before we leave. */ + if (__libc_enable_secure) + tunestr[off] = '\0'; } #endif |