Re: New GNU C Library (glibc) security flaw reported on 30 Jan 2024

[Xi Ruoyao <xry111@xry111.site>]

On Wed, 2024-01-31 at 14:08 +0000, Turritopsis Dohrnii Teo En Ming
wrote:
> Subject: New GNU C Library (glibc) security flaw reported on 30 Jan 2024
> 
> Good day from Singapore,
> 
> I recently stumbled upon this insightful article and wanted to share it with you.
> 
> Article: New Linux glibc flaw lets attackers get root on major distros
> Link: https://www.bleepingcomputer.com/news/security/new-linux-glibc-flaw-lets-attackers-get-root-on-major-distros/

I cannot see why https://www.qualys.com/2024/01/30/qsort.txt is a
**Glibc** security issue.  The standard is clear that if you pass a non-
transitive comparator to qsort, you invoke an undefined behavior.

While Glibc can try to make qsort "robust" due to the Hyrum rule, the
real security issue is in the programs calling qsort with bad
comparators.  Even if Glibc makes qsort "robust" those programs are
still vulnerable with a different libc.  Yes there is some security
issue, but the CVE numbers should be assigned to those broken programs,
not Glibc.

-- 
Xi Ruoyao <xry111@xry111.site>
School of Aerospace Science and Technology, Xidian University