diff options
author | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2023-09-19 18:39:32 -0400 |
---|---|---|
committer | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2023-10-02 15:41:55 -0400 |
commit | c84018a05aec80f5ee6f682db0da1130b0196aef (patch) | |
tree | 02055be5b5a45d966d5cacc876ce6c943978419b /elf/rtld.c | |
parent | 73d4ce728a59deb2fd18969e559769b3f590fac9 (diff) | |
download | glibc-c84018a05aec80f5ee6f682db0da1130b0196aef.tar.gz glibc-c84018a05aec80f5ee6f682db0da1130b0196aef.tar.xz glibc-c84018a05aec80f5ee6f682db0da1130b0196aef.zip |
tunables: Terminate if end of input is reached (CVE-2023-4911)
The string parsing routine may end up writing beyond bounds of tunestr if the input tunable string is malformed, of the form name=name=val. This gets processed twice, first as name=name=val and next as name=val, resulting in tunestr being name=name=val:name=val, thus overflowing tunestr. Terminate the parsing loop at the first instance itself so that tunestr does not overflow. This also fixes up tst-env-setuid-tunables to actually handle failures correct and add new tests to validate the fix for this CVE. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa)
Diffstat (limited to 'elf/rtld.c')
0 files changed, 0 insertions, 0 deletions