From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH] glibc: Fix CVE-2021-33574 and follow-up issue Date: Thu, 19 Aug 2021 12:07:06 +0000 Message-ID: <20210819120706.27601-1-michael.tremer@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8718270957616178236==" List-Id: --===============8718270957616178236== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The mq_notify function has a potential use-after-free issue when using a notification type of SIGEV_THREAD and a thread attribute with a non-default affinity mask. The fix for this introduced a NULL pointer dereference. Signed-off-by: Michael Tremer --- lfs/glibc | 4 + ...x-null-pointer-dereference-bug-28213.patch | 40 ++++++++++ ...ead_attr_copy-in-mq_notify-bug-27896.patch | 74 +++++++++++++++++++ 3 files changed, 118 insertions(+) create mode 100644 src/patches/glibc-2.33-librt-fix-null-pointer-dereference= -bug-28213.patch create mode 100644 src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_noti= fy-bug-27896.patch diff --git a/lfs/glibc b/lfs/glibc index aa7948aed..5dbc386d7 100644 --- a/lfs/glibc +++ b/lfs/glibc @@ -109,6 +109,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) $(DIR_SRC)/glibc-build && cd $(DIR_SRC) && tar axf $(DIR= _DL)/$(DL_FILE) @mkdir $(DIR_SRC)/glibc-build =20 + # Security Fixes + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-2.33-use-__pthre= ad_attr_copy-in-mq_notify-bug-27896.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-2.33-librt-fix-n= ull-pointer-dereference-bug-28213.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-localedef-no-arc= hive.patch =20 ifneq "$(TOOLCHAIN)" "1" diff --git a/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28= 213.patch b/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-282= 13.patch new file mode 100644 index 000000000..d2083e6e2 --- /dev/null +++ b/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.pat= ch @@ -0,0 +1,40 @@ +From 27a78fd712c06748737dfa9638fab96ea362fca9 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Mon, 9 Aug 2021 20:17:34 +0530 +Subject: [PATCH] librt: fix NULL pointer dereference (bug 28213) + +Helper thread frees copied attribute on NOTIFY_REMOVED message +received from the OS kernel. Unfortunately, it fails to check whether +copied attribute actually exists (data.attr !=3D NULL). This worked +earlier because free() checks passed pointer before actually +attempting to release corresponding memory. But +__pthread_attr_destroy assumes pointer is not NULL. + +So passing NULL pointer to __pthread_attr_destroy will result in +segmentation fault. This scenario is possible if +notification->sigev_notify_attributes =3D=3D NULL (which means default +thread attributes should be used). + +Signed-off-by: Nikita Popov +Reviewed-by: Siddhesh Poyarekar +(cherry picked from commit b805aebd42364fe696e417808a700fdb9800c9e8) +--- + sysdeps/unix/sysv/linux/mq_notify.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/m= q_notify.c +index 6f46d29d1d..1714e1cc5f 100644 +--- a/sysdeps/unix/sysv/linux/mq_notify.c ++++ b/sysdeps/unix/sysv/linux/mq_notify.c +@@ -132,7 +132,7 @@ helper_thread (void *arg) + to wait until it is done with it. */ + (void) __pthread_barrier_wait (¬ify_barrier); + } +- else if (data.raw[NOTIFY_COOKIE_LEN - 1] =3D=3D NOTIFY_REMOVED) ++ else if (data.raw[NOTIFY_COOKIE_LEN - 1] =3D=3D NOTIFY_REMOVED && dat= a.attr !=3D NULL) + { + /* The only state we keep is the copy of the thread attributes. */ + pthread_attr_destroy (data.attr); +--=20 +2.20.1 + diff --git a/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-= 27896.patch b/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug= -27896.patch new file mode 100644 index 000000000..f846b37b8 --- /dev/null +++ b/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.p= atch @@ -0,0 +1,74 @@ +From 4b6be914bd3920500a67ef6ca1aa7d1c37e5e859 Mon Sep 17 00:00:00 2001 +From: Andreas Schwab +Date: Thu, 27 May 2021 12:49:47 +0200 +Subject: [PATCH] Use __pthread_attr_copy in mq_notify (bug 27896) + +Make a deep copy of the pthread attribute object to remove a potential +use-after-free issue. + +(cherry picked from commit 42d359350510506b87101cf77202fefcbfc790cb) +--- + NEWS | 6 ++++++ + sysdeps/unix/sysv/linux/mq_notify.c | 15 ++++++++++----- + 2 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/NEWS b/NEWS +index 0c33a80af9..b9e570b4a4 100644 +--- a/NEWS ++++ b/NEWS +@@ -13,6 +13,12 @@ Major new features: + a dump of information related to IFUNC resolver operation and + glibc-hwcaps subdirectory selection. +=20 ++Security related changes: ++ ++ CVE-2021-33574: The mq_notify function has a potential use-after-free ++ issue when using a notification type of SIGEV_THREAD and a thread ++ attribute with a non-default affinity mask. ++ + The following bugs are resolved with this release: +=20 + [15271] dlfcn function failure after dlmopen terminates process +diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/m= q_notify.c +index cc575a0cdd..f7ddfe5a6c 100644 +--- a/sysdeps/unix/sysv/linux/mq_notify.c ++++ b/sysdeps/unix/sysv/linux/mq_notify.c +@@ -133,8 +133,11 @@ helper_thread (void *arg) + (void) __pthread_barrier_wait (¬ify_barrier); + } + else if (data.raw[NOTIFY_COOKIE_LEN - 1] =3D=3D NOTIFY_REMOVED) +- /* The only state we keep is the copy of the thread attributes. */ +- free (data.attr); ++ { ++ /* The only state we keep is the copy of the thread attributes. */ ++ pthread_attr_destroy (data.attr); ++ free (data.attr); ++ } + } + return NULL; + } +@@ -255,8 +258,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notificat= ion) + if (data.attr =3D=3D NULL) + return -1; +=20 +- memcpy (data.attr, notification->sigev_notify_attributes, +- sizeof (pthread_attr_t)); ++ __pthread_attr_copy (data.attr, notification->sigev_notify_attributes= ); + } +=20 + /* Construct the new request. */ +@@ -270,7 +272,10 @@ mq_notify (mqd_t mqdes, const struct sigevent *notifica= tion) +=20 + /* If it failed, free the allocated memory. */ + if (__glibc_unlikely (retval !=3D 0)) +- free (data.attr); ++ { ++ pthread_attr_destroy (data.attr); ++ free (data.attr); ++ } +=20 + return retval; + } +--=20 +2.20.1 + --=20 2.20.1 --===============8718270957616178236==--