[PATCH] glibc: Fix CVE-2021-33574 and follow-up issue

[PATCH] glibc: Fix CVE-2021-33574 and follow-up issue

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 6437 bytes --]

The mq_notify function has a potential use-after-free issue when using a
notification type of SIGEV_THREAD and a thread attribute with a non-default
affinity mask.

The fix for this introduced a NULL pointer dereference.

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 lfs/glibc                                     |  4 +
 ...x-null-pointer-dereference-bug-28213.patch | 40 ++++++++++
 ...ead_attr_copy-in-mq_notify-bug-27896.patch | 74 +++++++++++++++++++
 3 files changed, 118 insertions(+)
 create mode 100644 src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch
 create mode 100644 src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch

diff --git a/lfs/glibc b/lfs/glibc
index aa7948aed..5dbc386d7 100644
--- a/lfs/glibc
+++ b/lfs/glibc
@@ -109,6 +109,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@rm -rf $(DIR_APP) $(DIR_SRC)/glibc-build && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 	@mkdir $(DIR_SRC)/glibc-build
 
+	# Security Fixes
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch
+
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-localedef-no-archive.patch
 
 ifneq "$(TOOLCHAIN)" "1"
diff --git a/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch b/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch
new file mode 100644
index 000000000..d2083e6e2
--- /dev/null
+++ b/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch
@@ -0,0 +1,40 @@
+From 27a78fd712c06748737dfa9638fab96ea362fca9 Mon Sep 17 00:00:00 2001
+From: Nikita Popov <npv1310(a)gmail.com>
+Date: Mon, 9 Aug 2021 20:17:34 +0530
+Subject: [PATCH] librt: fix NULL pointer dereference (bug 28213)
+
+Helper thread frees copied attribute on NOTIFY_REMOVED message
+received from the OS kernel.  Unfortunately, it fails to check whether
+copied attribute actually exists (data.attr != NULL).  This worked
+earlier because free() checks passed pointer before actually
+attempting to release corresponding memory.  But
+__pthread_attr_destroy assumes pointer is not NULL.
+
+So passing NULL pointer to __pthread_attr_destroy will result in
+segmentation fault.  This scenario is possible if
+notification->sigev_notify_attributes == NULL (which means default
+thread attributes should be used).
+
+Signed-off-by: Nikita Popov <npv1310(a)gmail.com>
+Reviewed-by: Siddhesh Poyarekar <siddhesh(a)sourceware.org>
+(cherry picked from commit b805aebd42364fe696e417808a700fdb9800c9e8)
+---
+ sysdeps/unix/sysv/linux/mq_notify.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c
+index 6f46d29d1d..1714e1cc5f 100644
+--- a/sysdeps/unix/sysv/linux/mq_notify.c
++++ b/sysdeps/unix/sysv/linux/mq_notify.c
+@@ -132,7 +132,7 @@ helper_thread (void *arg)
+ 	       to wait until it is done with it.  */
+ 	    (void) __pthread_barrier_wait (&notify_barrier);
+ 	}
+-      else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED)
++      else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED && data.attr != NULL)
+ 	{
+ 	  /* The only state we keep is the copy of the thread attributes.  */
+ 	  pthread_attr_destroy (data.attr);
+-- 
+2.20.1
+
diff --git a/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch b/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch
new file mode 100644
index 000000000..f846b37b8
--- /dev/null
+++ b/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch
@@ -0,0 +1,74 @@
+From 4b6be914bd3920500a67ef6ca1aa7d1c37e5e859 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab(a)linux-m68k.org>
+Date: Thu, 27 May 2021 12:49:47 +0200
+Subject: [PATCH] Use __pthread_attr_copy in mq_notify (bug 27896)
+
+Make a deep copy of the pthread attribute object to remove a potential
+use-after-free issue.
+
+(cherry picked from commit 42d359350510506b87101cf77202fefcbfc790cb)
+---
+ NEWS                                |  6 ++++++
+ sysdeps/unix/sysv/linux/mq_notify.c | 15 ++++++++++-----
+ 2 files changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/NEWS b/NEWS
+index 0c33a80af9..b9e570b4a4 100644
+--- a/NEWS
++++ b/NEWS
+@@ -13,6 +13,12 @@ Major new features:
+   a dump of information related to IFUNC resolver operation and
+   glibc-hwcaps subdirectory selection.
+ 
++Security related changes:
++
++  CVE-2021-33574: The mq_notify function has a potential use-after-free
++  issue when using a notification type of SIGEV_THREAD and a thread
++  attribute with a non-default affinity mask.
++
+ The following bugs are resolved with this release:
+ 
+   [15271] dlfcn function failure after dlmopen terminates process
+diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c
+index cc575a0cdd..f7ddfe5a6c 100644
+--- a/sysdeps/unix/sysv/linux/mq_notify.c
++++ b/sysdeps/unix/sysv/linux/mq_notify.c
+@@ -133,8 +133,11 @@ helper_thread (void *arg)
+ 	    (void) __pthread_barrier_wait (&notify_barrier);
+ 	}
+       else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED)
+-	/* The only state we keep is the copy of the thread attributes.  */
+-	free (data.attr);
++	{
++	  /* The only state we keep is the copy of the thread attributes.  */
++	  pthread_attr_destroy (data.attr);
++	  free (data.attr);
++	}
+     }
+   return NULL;
+ }
+@@ -255,8 +258,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
+       if (data.attr == NULL)
+ 	return -1;
+ 
+-      memcpy (data.attr, notification->sigev_notify_attributes,
+-	      sizeof (pthread_attr_t));
++      __pthread_attr_copy (data.attr, notification->sigev_notify_attributes);
+     }
+ 
+   /* Construct the new request.  */
+@@ -270,7 +272,10 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
+ 
+   /* If it failed, free the allocated memory.  */
+   if (__glibc_unlikely (retval != 0))
+-    free (data.attr);
++    {
++      pthread_attr_destroy (data.attr);
++      free (data.attr);
++    }
+ 
+   return retval;
+ }
+-- 
+2.20.1
+
-- 
2.20.1