[Bug malloc/25945] memory block return by tcache_get() may contain anather valid memory block pointer, leading to information disclosure

["carlos at redhat dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=25945

Carlos O'Donell <carlos at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |carlos at redhat dot com

--- Comment #3 from Carlos O'Donell <carlos at redhat dot com> ---
Wangxu,

Thank you very much for the report and the discussion of possible leakage of
the ASLR bits via chunk re-use.

Since we are only clearing an additional pointer-sized word per chunk, and the
chunk is already in cache (previously touched), the cost to change this
additional word is probably not measurable.

However, we need a little more because we want to prevent the disclosure of
ASLR bits in the tcache *and* fastbin chunks.

diff --git a/malloc/malloc.c b/malloc/malloc.c
index ee87ddbbf9..970e4b5e3d 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -2953,7 +2953,11 @@ tcache_get (size_t tc_idx)
     malloc_printerr ("malloc(): unaligned tcache chunk detected");
   tcache->entries[tc_idx] = REVEAL_PTR (e->next);
   --(tcache->counts[tc_idx]);
+  /* Clear the key to make free's double-free check effective.  */
   e->key = NULL;
+  /* Clear the Safe-Link'ed pointer to avoid a user from being
+     able to print this and expose ASLR bits.  */
+  e->next = NULL;
   return (void *) e;
 }

@@ -3613,6 +3617,7 @@ _int_malloc (mstate av, size_t bytes)
            *fb = REVEAL_PTR (victim->fd);
          else
            REMOVE_FB (fb, pp, victim);
+
          if (__glibc_likely (victim != NULL))
            {
              size_t victim_idx = fastbin_index (chunksize (victim));
@@ -3646,6 +3651,9 @@ _int_malloc (mstate av, size_t bytes)
                }
 #endif
              void *p = chunk2mem (victim);
+             /* Clear the Safe-Link'ed pointer to avoid a user from being
+                able to print this and expose ASLR bits.  */
+             victim->fd = NULL;
              alloc_perturb (p, bytes);
              return p;
            }
---

-- 
You are receiving this mail because:
You are on the CC list for the bug.