From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 111684 invoked by alias); 28 Mar 2018 20:44:13 -0000 Mailing-List: contact libc-stable-help@sourceware.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Subscribe: List-Archive: Sender: libc-stable-owner@sourceware.org Received: (qmail 110073 invoked by uid 89); 28 Mar 2018 20:44:12 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.99.4 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-26.6 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.2 spammy= X-Spam-Status: No, score=-26.6 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sourceware.org X-Spam-Level: X-HELO: mx0a-001b2d01.pphosted.com Received: from mx0a-001b2d01.pphosted.com (HELO mx0a-001b2d01.pphosted.com) (148.163.156.1) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Wed, 28 Mar 2018 20:44:10 +0000 Received: from pps.filterd (m0098396.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w2SKequt120909 for ; Wed, 28 Mar 2018 16:44:09 -0400 Received: from e13.ny.us.ibm.com (e13.ny.us.ibm.com [129.33.205.203]) by mx0a-001b2d01.pphosted.com with ESMTP id 2h0j47gh60-1 (version=TLSv1.2 cipher=AES256-SHA256 bits=256 verify=NOT) for ; Wed, 28 Mar 2018 16:44:09 -0400 Received: from localhost by e13.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 28 Mar 2018 16:44:08 -0400 Received: from b01cxnp23034.gho.pok.ibm.com (9.57.198.29) by e13.ny.us.ibm.com (146.89.104.200) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 28 Mar 2018 16:44:05 -0400 Received: from b01ledav005.gho.pok.ibm.com (b01ledav005.gho.pok.ibm.com [9.57.199.110]) by b01cxnp23034.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id w2SKi5nI50200676 for ; Wed, 28 Mar 2018 20:44:05 GMT Received: from b01ledav005.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 76AE4AE034 for ; Wed, 28 Mar 2018 16:45:42 -0400 (EDT) Received: from localhost (unknown [9.85.149.193]) by b01ledav005.gho.pok.ibm.com (Postfix) with ESMTP id 68DEDAE04E for ; Wed, 28 Mar 2018 16:45:41 -0400 (EDT) From: Raphael Moreira Zinsly To: libc-stable@sourceware.org Subject: [PATCH 2.22 09/14] elf: Compute correct array size in _dl_init_paths [BZ #22606] Date: Mon, 01 Jan 2018 00:00:00 -0000 X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1522269821-15007-1-git-send-email-rzinsly@linux.vnet.ibm.com> References: <1522269821-15007-1-git-send-email-rzinsly@linux.vnet.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 18032820-0008-0000-0000-000002EC42E3 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00008760; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000255; SDB=6.01009783; UDB=6.00514430; IPR=6.00789065; MB=3.00020296; MTD=3.00000008; XFM=3.00000015; UTC=2018-03-28 20:44:07 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18032820-0009-0000-0000-000038B5A047 Message-Id: <1522269821-15007-9-git-send-email-rzinsly@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2018-03-28_07:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1803280211 X-SW-Source: 2018-03/txt/msg00047.txt.bz2 From: Florian Weimer (cherry picked from commit 8a0b17e48b83e933960dfeb8fa08b259f03f310e) --- ChangeLog | 8 ++++++++ NEWS | 5 +++++ elf/dl-load.c | 14 +++++++------- 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index 48fc023..890b97d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,14 @@ 2017-12-14 Florian Weimer + [BZ #22606] + CVE-2017-1000408 + * elf/dl-load.c (system_dirs): Update comment. + (nsystem_dirs_len): Use array_length. + (_dl_init_paths): Use nsystem_dirs_len to compute the array size. + +2017-12-14 Florian Weimer + [BZ #22607] CVE-2017-1000409 * elf/dl-load.c (_dl_init_paths): Compute number of components in diff --git a/NEWS b/NEWS index ea8e17c..7c090fe 100644 --- a/NEWS +++ b/NEWS @@ -85,6 +85,11 @@ Version 2.22.1 CVE-2017-1000366 has been applied, but it is mentioned here only because of the CVE assignment.) Reported by Qualys. +* CVE-2017-1000408: Incorrect array size computation in _dl_init_paths leads + to the allocation of too much memory. (This is not a security bug per se, + it is mentioned here only because of the CVE assignment.) Reported by + Qualys. + Version 2.22 diff --git a/elf/dl-load.c b/elf/dl-load.c index f22fd0d..32c3159 100644 --- a/elf/dl-load.c +++ b/elf/dl-load.c @@ -36,6 +36,7 @@ #include #include #include +#include #include #include @@ -102,7 +103,9 @@ static size_t ncapstr attribute_relro; static size_t max_capstrlen attribute_relro; -/* Get the generated information about the trusted directories. */ +/* Get the generated information about the trusted directories. Use + an array of concatenated strings to avoid relocations. See + gen-trusted-dirs.awk. */ #include "trusted-dirs.h" static const char system_dirs[] = SYSTEM_DIRS; @@ -110,9 +113,7 @@ static const size_t system_dirs_len[] = { SYSTEM_DIRS_LEN }; -#define nsystem_dirs_len \ - (sizeof (system_dirs_len) / sizeof (system_dirs_len[0])) - +#define nsystem_dirs_len array_length (system_dirs_len) static bool is_trusted_path (const char *path, size_t len) @@ -704,9 +705,8 @@ _dl_init_paths (const char *llp) + ncapstr * sizeof (enum r_dir_status)) / sizeof (struct r_search_path_elem)); - rtld_search_dirs.dirs[0] = (struct r_search_path_elem *) - malloc ((sizeof (system_dirs) / sizeof (system_dirs[0])) - * round_size * sizeof (struct r_search_path_elem)); + rtld_search_dirs.dirs[0] = malloc (nsystem_dirs_len * round_size + * sizeof (*rtld_search_dirs.dirs[0])); if (rtld_search_dirs.dirs[0] == NULL) { errstring = N_("cannot create cache for search path"); -- 1.8.3.1