Re: [committed 2/2] tunables: Terminate if end of input is reached (CVE-2023-4911)

[Siddhesh Poyarekar <siddhesh@sourceware.org>]

On 2023-10-03 14:07, Adhemerval Zanella Netto wrote:
> So how should we handle what might be inconsistent invalid inputs like:
> 
>    glibc.malloc.mmap_threshold=4096=4096
> 
> Since glibc does not provide any TUNABLE_SECLEVEL_NONE, this tunables
> will be ignored.  But for TUNABLE_SECLEVEL_NONE one, the value is
> still parsed by _dl_strtoul or stored in the tunable.
> 

Ack, it probably makes sense to drop all tunables that don't match at 
this stage.  Arjun is going to rework the parsing for pr#30683 and it 
probably makes sense to, in addition to enhancing the parsing, also weed 
out invalid inputs and harden around allocations for the tunable string 
to provide some resilience against overflows.

The other aspect to think about may be the utility of passing tunables 
to (or through) setuid programs.  I had done it to maintain 
compatibility with the malloc envvars that were getting passed through, 
but maybe it's a good idea to filter all of them out.  Perhaps with 
systemwide tunables we could even have a way for tunables to be read in 
sxid programs in a safer way.

Thanks,
Sid