diff options
| author | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2025-01-21 16:11:06 -0500 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2025-01-22 17:08:33 +0100 |
| commit | 808a84a8b81468b517a4d721fdc62069cb8c211f (patch) | |
| tree | d8d8f3205ebc5a1bce734291cbaa8b0d66b39057 | |
| parent | 994b129a35ca5218ecddd1add74aea68f1314560 (diff) | |
| download | glibc-808a84a8b81468b517a4d721fdc62069cb8c211f.tar.xz glibc-808a84a8b81468b517a4d721fdc62069cb8c211f.zip | |
Fix underallocation of abort_msg_s struct (CVE-2025-0395)
Include the space needed to store the length of the message itself, in
addition to the message string. This resolves BZ #32582.
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed: Adhemerval Zanella <adhemerval.zanella@linaro.org>
(cherry picked from commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578)
| -rw-r--r-- | NEWS | 5 | ||||
| -rw-r--r-- | assert/assert.c | 4 | ||||
| -rw-r--r-- | sysdeps/posix/libc_fatal.c | 4 |
3 files changed, 11 insertions, 2 deletions
@@ -34,6 +34,10 @@ The following CVEs were fixed in this release: nscd: netgroup cache assumes NSS callback uses in-buffer strings (CVE-2024-33602) + GLIBC-SA-2025-0001: + assert: Buffer overflow when printing assertion failure message + (CVE-2025-0395) + The following bugs are resolved with this release: [19622] network: Support aliasing with struct sockaddr @@ -94,6 +98,7 @@ The following bugs are resolved with this release: [32137] libio: Attempt wide backup free only for non-legacy code [32231] elf: Change ldconfig auxcache magic number [32470] x86: Avoid integer truncation with large cache sizes + [32582] Fix underallocation of abort_msg_s struct (CVE-2025-0395) Version 2.39 diff --git a/assert/assert.c b/assert/assert.c index c29629f5f6..b6e37d694c 100644 --- a/assert/assert.c +++ b/assert/assert.c @@ -18,6 +18,7 @@ #include <assert.h> #include <atomic.h> #include <ldsodefs.h> +#include <libc-pointer-arith.h> #include <libintl.h> #include <stdio.h> #include <stdlib.h> @@ -65,7 +66,8 @@ __assert_fail_base (const char *fmt, const char *assertion, const char *file, (void) __fxprintf (NULL, "%s", str); (void) fflush (stderr); - total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1); + total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1, + GLRO(dl_pagesize)); struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0); if (__glibc_likely (buf != MAP_FAILED)) diff --git a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c index f9e3425e04..089c47b04b 100644 --- a/sysdeps/posix/libc_fatal.c +++ b/sysdeps/posix/libc_fatal.c @@ -20,6 +20,7 @@ #include <errno.h> #include <fcntl.h> #include <ldsodefs.h> +#include <libc-pointer-arith.h> #include <paths.h> #include <stdarg.h> #include <stdbool.h> @@ -105,7 +106,8 @@ __libc_message_impl (const char *fmt, ...) { WRITEV_FOR_FATAL (fd, iov, iovcnt, total); - total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1); + total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1, + GLRO(dl_pagesize)); struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0); |