fix glibc CVE
This commit is contained in:
Henry Li
Родитель
2e70583100
Коммит
545af35e7c
|
|
@ -0,0 +1,217 @@
|
|||
diff --git a/./ChangeLog b/ChangeLog
|
||||
index 08b42bd..0e82190 100644
|
||||
--- a/ChangeLog
|
||||
+++ b/ChangeLog
|
||||
@@ -1,3 +1,14 @@
|
||||
+2019-02-04 H.J. Lu <hongjiu.lu@intel.com>
|
||||
+
|
||||
+ [BZ #24155]
|
||||
+ CVE-2019-7309
|
||||
+ * NEWS: Updated for CVE-2019-7309.
|
||||
+ * sysdeps/x86_64/memcmp.S: Use RDX_LP for size. Clear the
|
||||
+ upper 32 bits of RDX register for x32. Use unsigned Jcc
|
||||
+ instructions, instead of signed.
|
||||
+ * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memcmp-2.
|
||||
+ * sysdeps/x86_64/x32/tst-size_t-memcmp-2.c: New test.
|
||||
+
|
||||
2018-08-01 Carlos O'Donel <carlos@redhat.com>
|
||||
|
||||
* version.h (RELEASE): Set to "stable".
|
||||
diff --git a/NEWS b/NEWS
|
||||
index 154ab22..d254097 100644
|
||||
--- a/NEWS
|
||||
+++ b/NEWS
|
||||
@@ -240,6 +240,14 @@ Security related changes:
|
||||
architecture could write beyond the target buffer, resulting in a buffer
|
||||
overflow. Reported by Andreas Schwab.
|
||||
|
||||
+ CVE-2019-7309: x86-64 memcmp used signed Jcc instructions to check
|
||||
+ size. For x86-64, memcmp on an object size larger than SSIZE_MAX
|
||||
+ has undefined behavior. On x32, the size_t argument may be passed
|
||||
+ in the lower 32 bits of the 64-bit RDX register with non-zero upper
|
||||
+ 32 bits. When it happened with the sign bit of RDX register set,
|
||||
+ memcmp gave the wrong result since it treated the size argument as
|
||||
+ zero. Reported by H.J. Lu.
|
||||
+
|
||||
The following bugs are resolved with this release:
|
||||
|
||||
[1190] stdio: fgetc()/fread() behaviour is not POSIX compliant
|
||||
@@ -422,6 +430,7 @@ The following bugs are resolved with this release:
|
||||
[23459] libc: COMMON_CPUID_INDEX_80000001 isn't populated for Intel
|
||||
processors
|
||||
[23467] dynamic-link: x86/CET: A property note parser bug
|
||||
+ [24155] x32 memcmp can treat positive length as 0 (if sign bit in RDX is set) (CVE-2019-7309)
|
||||
|
||||
|
||||
Version 2.27
|
||||
|
||||
diff --git a/sysdeps/x86_64/memcmp.S b/sysdeps/x86_64/memcmp.S
|
||||
index bcb4a2e88d..45918d375a 100644
|
||||
--- a/sysdeps/x86_64/memcmp.S
|
||||
+++ b/sysdeps/x86_64/memcmp.S
|
||||
@@ -21,14 +21,18 @@
|
||||
|
||||
.text
|
||||
ENTRY (memcmp)
|
||||
- test %rdx, %rdx
|
||||
+#ifdef __ILP32__
|
||||
+ /* Clear the upper 32 bits. */
|
||||
+ movl %edx, %edx
|
||||
+#endif
|
||||
+ test %RDX_LP, %RDX_LP
|
||||
jz L(finz)
|
||||
cmpq $1, %rdx
|
||||
- jle L(finr1b)
|
||||
+ jbe L(finr1b)
|
||||
subq %rdi, %rsi
|
||||
movq %rdx, %r10
|
||||
cmpq $32, %r10
|
||||
- jge L(gt32)
|
||||
+ jae L(gt32)
|
||||
/* Handle small chunks and last block of less than 32 bytes. */
|
||||
L(small):
|
||||
testq $1, %r10
|
||||
@@ -156,7 +160,7 @@ L(A32):
|
||||
movq %r11, %r10
|
||||
andq $-32, %r10
|
||||
cmpq %r10, %rdi
|
||||
- jge L(mt16)
|
||||
+ jae L(mt16)
|
||||
/* Pre-unroll to be ready for unrolled 64B loop. */
|
||||
testq $32, %rdi
|
||||
jz L(A64)
|
||||
@@ -178,7 +182,7 @@ L(A64):
|
||||
movq %r11, %r10
|
||||
andq $-64, %r10
|
||||
cmpq %r10, %rdi
|
||||
- jge L(mt32)
|
||||
+ jae L(mt32)
|
||||
|
||||
L(A64main):
|
||||
movdqu (%rdi,%rsi), %xmm0
|
||||
@@ -216,7 +220,7 @@ L(mt32):
|
||||
movq %r11, %r10
|
||||
andq $-32, %r10
|
||||
cmpq %r10, %rdi
|
||||
- jge L(mt16)
|
||||
+ jae L(mt16)
|
||||
|
||||
L(A32main):
|
||||
movdqu (%rdi,%rsi), %xmm0
|
||||
@@ -254,7 +258,7 @@ L(ATR):
|
||||
movq %r11, %r10
|
||||
andq $-32, %r10
|
||||
cmpq %r10, %rdi
|
||||
- jge L(mt16)
|
||||
+ jae L(mt16)
|
||||
testq $16, %rdi
|
||||
jz L(ATR32)
|
||||
|
||||
@@ -325,7 +329,7 @@ L(ATR64main):
|
||||
movq %r11, %r10
|
||||
andq $-32, %r10
|
||||
cmpq %r10, %rdi
|
||||
- jge L(mt16)
|
||||
+ jae L(mt16)
|
||||
|
||||
L(ATR32res):
|
||||
movdqa (%rdi,%rsi), %xmm0
|
||||
diff --git a/sysdeps/x86_64/x32/Makefile b/sysdeps/x86_64/x32/Makefile
|
||||
index f2ebc24..457c707 100644
|
||||
--- a/sysdeps/x86_64/x32/Makefile
|
||||
+++ b/sysdeps/x86_64/x32/Makefile
|
||||
@@ -4,3 +4,7 @@ ifeq ($(subdir),math)
|
||||
# 64-bit llround. Add -fno-builtin-lround to silence the compiler.
|
||||
CFLAGS-s_llround.c += -fno-builtin-lround
|
||||
endif
|
||||
+
|
||||
+ifeq ($(subdir),string)
|
||||
+ tests += tst-size_t-memcmp-2
|
||||
+endif
|
||||
\ No newline at end of file
|
||||
diff --git a/sysdeps/x86_64/x32/tst-size_t-memcmp-2.c b/sysdeps/x86_64/x32/tst-size_t-memcmp-2.c
|
||||
new file mode 100644
|
||||
index 0000000000..d8ae1a0813
|
||||
--- /dev/null
|
||||
+++ b/sysdeps/x86_64/x32/tst-size_t-memcmp-2.c
|
||||
@@ -0,0 +1,79 @@
|
||||
+/* Test memcmp with size_t in the lower 32 bits of 64-bit register.
|
||||
+ Copyright (C) 2019 Free Software Foundation, Inc.
|
||||
+ This file is part of the GNU C Library.
|
||||
+
|
||||
+ The GNU C Library is free software; you can redistribute it and/or
|
||||
+ modify it under the terms of the GNU Lesser General Public
|
||||
+ License as published by the Free Software Foundation; either
|
||||
+ version 2.1 of the License, or (at your option) any later version.
|
||||
+
|
||||
+ The GNU C Library is distributed in the hope that it will be useful,
|
||||
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
+ Lesser General Public License for more details.
|
||||
+
|
||||
+ You should have received a copy of the GNU Lesser General Public
|
||||
+ License along with the GNU C Library; if not, see
|
||||
+ <http://www.gnu.org/licenses/>. */
|
||||
+
|
||||
+#define TEST_MAIN
|
||||
+#ifdef WIDE
|
||||
+# define TEST_NAME "wmemcmp"
|
||||
+#else
|
||||
+# define TEST_NAME "memcmp"
|
||||
+#endif
|
||||
+
|
||||
+#include "test-size_t.h"
|
||||
+
|
||||
+#ifdef WIDE
|
||||
+# include <inttypes.h>
|
||||
+# include <wchar.h>
|
||||
+
|
||||
+# define MEMCMP wmemcmp
|
||||
+# define CHAR wchar_t
|
||||
+#else
|
||||
+# define MEMCMP memcmp
|
||||
+# define CHAR char
|
||||
+#endif
|
||||
+
|
||||
+IMPL (MEMCMP, 1)
|
||||
+
|
||||
+typedef int (*proto_t) (const CHAR *, const CHAR *, size_t);
|
||||
+
|
||||
+static int
|
||||
+__attribute__ ((noinline, noclone))
|
||||
+do_memcmp (parameter_t a, parameter_t b)
|
||||
+{
|
||||
+ return CALL (&b, a.p, b.p, a.len);
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+test_main (void)
|
||||
+{
|
||||
+ test_init ();
|
||||
+
|
||||
+ parameter_t dest = { { page_size / sizeof (CHAR) }, buf1 };
|
||||
+ parameter_t src = { { 0 }, buf2 };
|
||||
+
|
||||
+ memcpy (buf1, buf2, page_size);
|
||||
+
|
||||
+ CHAR *p = (CHAR *) buf1;
|
||||
+ p[page_size / sizeof (CHAR) - 1] = (CHAR) 1;
|
||||
+
|
||||
+ int ret = 0;
|
||||
+ FOR_EACH_IMPL (impl, 0)
|
||||
+ {
|
||||
+ src.fn = impl->fn;
|
||||
+ int res = do_memcmp (dest, src);
|
||||
+ if (res >= 0)
|
||||
+ {
|
||||
+ error (0, 0, "Wrong result in function %s: %i >= 0",
|
||||
+ impl->name, res);
|
||||
+ ret = 1;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ return ret ? EXIT_FAILURE : EXIT_SUCCESS;
|
||||
+}
|
||||
+
|
||||
+#include <support/test-driver.c>
|
||||
--
|
||||
|
|
@ -5,7 +5,7 @@
|
|||
Summary: Main C library
|
||||
Name: glibc
|
||||
Version: 2.28
|
||||
Release: 12%{?dist}
|
||||
Release: 13%{?dist}
|
||||
License: LGPLv2+
|
||||
URL: https://www.gnu.org/software/libc
|
||||
Group: Applications/System
|
||||
|
|
@ -31,6 +31,7 @@ Patch10: CVE-2020-1751.nopatch
|
|||
# Marked by upstream/Ubuntu/Red Hat as not a security bug, no fix available
|
||||
# Rationale: Exploit requires crafted pattern in regex compiler meant only for trusted content
|
||||
Patch11: CVE-2018-20796.nopatch
|
||||
Patch12: CVE-2019-7309.patch
|
||||
ExcludeArch: armv7 ppc i386 i686
|
||||
Provides: rtld(GNU_HASH)
|
||||
Provides: /sbin/ldconfig
|
||||
|
|
@ -84,16 +85,8 @@ Requires: %{name} = %{version}-%{release}
|
|||
Name Service Cache Daemon
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
%autosetup -p1
|
||||
sed -i 's/\\$$(pwd)/`pwd`/' timezone/Makefile
|
||||
%patch0 -p1
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
%patch6 -p1
|
||||
%patch7 -p1
|
||||
install -vdm 755 %{_builddir}/%{name}-build
|
||||
# do not try to explicitly provide GLIBC_PRIVATE versioned libraries
|
||||
%define __find_provides %{_builddir}/%{name}-%{version}/find_provides.sh
|
||||
|
|
@ -308,6 +301,10 @@ grep "^FAIL: nptl/tst-eintr1" tests.sum >/dev/null && n=$((n+1)) ||:
|
|||
|
||||
|
||||
%changelog
|
||||
* Wed Oct 28 2020 Henry Li <lihl@microsoft.com> - 2.28-13
|
||||
- Used autosetup
|
||||
- Added patch to resolve CVE-2019-7309
|
||||
|
||||
* Wed Jul 29 2020 Thomas Crain <thcrain@microsoft.com> - 2.28-12
|
||||
- Ignore CVE-2018-20796, as it is not a security issue
|
||||
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче