mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-28 11:43:25 +02:00
a61a21ef75
These include (amongst others) fixes for: GLIBC-SA-2024-0001: =================== syslog: Heap buffer overflow in __vsyslog_internal (CVE-2023-6246) __vsyslog_internal did not handle a case where printing a SYSLOG_HEADER containing a long program name failed to update the required buffer size, leading to the allocation and overflow of a too-small buffer on the heap. GLIBC-SA-2024-0002: =================== syslog: Heap buffer overflow in __vsyslog_internal (CVE-2023-6779) __vsyslog_internal used the return value of snprintf/vsnprintf to calculate buffer sizes for memory allocation. If these functions (for any reason) failed and returned -1, the resulting buffer would be too small to hold output. GLIBC-SA-2024-0003: =================== syslog: Integer overflow in __vsyslog_internal (CVE-2023-6780) __vsyslog_internal calculated a buffer size by adding two integers, but did not first check if the addition would overflow. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
55 lines
2.2 KiB
Diff
55 lines
2.2 KiB
Diff
From ccdc4cba07684fe1397e1f5f134a0a827af98c04 Mon Sep 17 00:00:00 2001
|
|
From: Hector Martin <marcan@marcan.st>
|
|
Date: Tue, 28 Nov 2023 15:23:07 +0900
|
|
Subject: [PATCH 34/44] elf: Fix TLS modid reuse generation assignment (BZ
|
|
29039)
|
|
|
|
_dl_assign_tls_modid() assigns a slotinfo entry for a new module, but
|
|
does *not* do anything to the generation counter. The first time this
|
|
happens, the generation is zero and map_generation() returns the current
|
|
generation to be used during relocation processing. However, if
|
|
a slotinfo entry is later reused, it will already have a generation
|
|
assigned. If this generation has fallen behind the current global max
|
|
generation, then this causes an obsolete generation to be assigned
|
|
during relocation processing, as map_generation() returns this
|
|
generation if nonzero. _dl_add_to_slotinfo() eventually resets the
|
|
generation, but by then it is too late. This causes DTV updates to be
|
|
skipped, leading to NULL or broken TLS slot pointers and segfaults.
|
|
|
|
Fix this by resetting the generation to zero in _dl_assign_tls_modid(),
|
|
so it behaves the same as the first time a slot is assigned.
|
|
_dl_add_to_slotinfo() will still assign the correct static generation
|
|
later during module load, but relocation processing will no longer use
|
|
an obsolete generation.
|
|
|
|
Note that slotinfo entry (aka modid) reuse typically happens after a
|
|
dlclose and only TLS access via dynamic tlsdesc is affected. Because
|
|
tlsdesc is optimized to use the optional part of static TLS, dynamic
|
|
tlsdesc can be avoided by increasing the glibc.rtld.optional_static_tls
|
|
tunable to a large enough value, or by LD_PRELOAD-ing the affected
|
|
modules.
|
|
|
|
Fixes bug 29039.
|
|
|
|
Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
|
|
(cherry picked from commit 3921c5b40f293c57cb326f58713c924b0662ef59)
|
|
---
|
|
elf/dl-tls.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/elf/dl-tls.c b/elf/dl-tls.c
|
|
index 99b83ca696..1f6f820819 100644
|
|
--- a/elf/dl-tls.c
|
|
+++ b/elf/dl-tls.c
|
|
@@ -154,6 +154,7 @@ _dl_assign_tls_modid (struct link_map *l)
|
|
{
|
|
/* Mark the entry as used, so any dependency see it. */
|
|
atomic_store_relaxed (&runp->slotinfo[result - disp].map, l);
|
|
+ atomic_store_relaxed (&runp->slotinfo[result - disp].gen, 0);
|
|
break;
|
|
}
|
|
|
|
--
|
|
2.39.2
|
|
|