From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id B986D3983015; Fri, 8 May 2020 16:19:51 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B986D3983015 From: "carlos at redhat dot com" To: glibc-bugs@sourceware.org Subject: [Bug malloc/25945] memory block return by tcache_get() may contain anather valid memory block pointer, leading to information disclosure Date: Fri, 08 May 2020 16:19:51 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: glibc X-Bugzilla-Component: malloc X-Bugzilla-Version: 2.26 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: carlos at redhat dot com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: cc Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: glibc-bugs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Glibc-bugs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 May 2020 16:19:51 -0000 https://sourceware.org/bugzilla/show_bug.cgi?id=3D25945 Carlos O'Donell changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |carlos at redhat dot com --- Comment #3 from Carlos O'Donell --- Wangxu, Thank you very much for the report and the discussion of possible leakage of the ASLR bits via chunk re-use. Since we are only clearing an additional pointer-sized word per chunk, and = the chunk is already in cache (previously touched), the cost to change this additional word is probably not measurable. However, we need a little more because we want to prevent the disclosure of ASLR bits in the tcache *and* fastbin chunks. diff --git a/malloc/malloc.c b/malloc/malloc.c index ee87ddbbf9..970e4b5e3d 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -2953,7 +2953,11 @@ tcache_get (size_t tc_idx) malloc_printerr ("malloc(): unaligned tcache chunk detected"); tcache->entries[tc_idx] =3D REVEAL_PTR (e->next); --(tcache->counts[tc_idx]); + /* Clear the key to make free's double-free check effective. */ e->key =3D NULL; + /* Clear the Safe-Link'ed pointer to avoid a user from being + able to print this and expose ASLR bits. */ + e->next =3D NULL; return (void *) e; } @@ -3613,6 +3617,7 @@ _int_malloc (mstate av, size_t bytes) *fb =3D REVEAL_PTR (victim->fd); else REMOVE_FB (fb, pp, victim); + if (__glibc_likely (victim !=3D NULL)) { size_t victim_idx =3D fastbin_index (chunksize (victim)); @@ -3646,6 +3651,9 @@ _int_malloc (mstate av, size_t bytes) } #endif void *p =3D chunk2mem (victim); + /* Clear the Safe-Link'ed pointer to avoid a user from being + able to print this and expose ASLR bits. */ + victim->fd =3D NULL; alloc_perturb (p, bytes); return p; } --- --=20 You are receiving this mail because: You are on the CC list for the bug.=