|
| 1 | +From 39831529db8f5b989f8e5c029118af68c32008fd Mon Sep 17 00:00:00 2001 |
| 2 | +From: Florian Weimer <fweimer@redhat.com> |
| 3 | +Date: Wed, 22 Jan 2025 17:22:02 +0100 |
| 4 | +Subject: [PATCH] Fix underallocation of abort_msg_s struct (CVE-2025-0395) |
| 5 | + |
| 6 | +Include the space needed to store the length of the message itself, in |
| 7 | +addition to the message string. This resolves BZ #32582. |
| 8 | + |
| 9 | +Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> |
| 10 | +Reviewed: Adhemerval Zanella <adhemerval.zanella@linaro.org> |
| 11 | +(cherry picked from commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578) |
| 12 | + |
| 13 | +Conflict in sysdeps/posix/libc_fatal.c due to missing cleanup after |
| 14 | +backtrace removal. |
| 15 | + |
| 16 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 17 | +Upstream-reference: https://github.com/bminor/glibc/commit/8b5d4be762419c4f6176261c6fea40ac559b88dc.patch |
| 18 | +--- |
| 19 | + assert/assert.c | 4 +++- |
| 20 | + sysdeps/posix/libc_fatal.c | 5 +++-- |
| 21 | + 2 files changed, 6 insertions(+), 3 deletions(-) |
| 22 | + |
| 23 | +diff --git a/assert/assert.c b/assert/assert.c |
| 24 | +index 133a183b..9e55eeb4 100644 |
| 25 | +--- a/assert/assert.c |
| 26 | ++++ b/assert/assert.c |
| 27 | +@@ -18,6 +18,7 @@ |
| 28 | + #include <assert.h> |
| 29 | + #include <atomic.h> |
| 30 | + #include <ldsodefs.h> |
| 31 | ++#include <libc-pointer-arith.h> |
| 32 | + #include <libintl.h> |
| 33 | + #include <stdio.h> |
| 34 | + #include <stdlib.h> |
| 35 | +@@ -64,7 +65,8 @@ __assert_fail_base (const char *fmt, const char *assertion, const char *file, |
| 36 | + (void) __fxprintf (NULL, "%s", str); |
| 37 | + (void) fflush (stderr); |
| 38 | + |
| 39 | +- total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1); |
| 40 | ++ total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1, |
| 41 | ++ GLRO(dl_pagesize)); |
| 42 | + struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE, |
| 43 | + MAP_ANON | MAP_PRIVATE, -1, 0); |
| 44 | + if (__glibc_likely (buf != MAP_FAILED)) |
| 45 | +diff --git a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c |
| 46 | +index 2ee0010b..dfa07805 100644 |
| 47 | +--- a/sysdeps/posix/libc_fatal.c |
| 48 | ++++ b/sysdeps/posix/libc_fatal.c |
| 49 | +@@ -20,6 +20,7 @@ |
| 50 | + #include <errno.h> |
| 51 | + #include <fcntl.h> |
| 52 | + #include <ldsodefs.h> |
| 53 | ++#include <libc-pointer-arith.h> |
| 54 | + #include <paths.h> |
| 55 | + #include <stdarg.h> |
| 56 | + #include <stdbool.h> |
| 57 | +@@ -125,8 +126,8 @@ __libc_message (enum __libc_message_action action, const char *fmt, ...) |
| 58 | + |
| 59 | + if ((action & do_abort)) |
| 60 | + { |
| 61 | +- total = ((total + 1 + GLRO(dl_pagesize) - 1) |
| 62 | +- & ~(GLRO(dl_pagesize) - 1)); |
| 63 | ++ total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1, |
| 64 | ++ GLRO(dl_pagesize)); |
| 65 | + struct abort_msg_s *buf = __mmap (NULL, total, |
| 66 | + PROT_READ | PROT_WRITE, |
| 67 | + MAP_ANON | MAP_PRIVATE, -1, 0); |
| 68 | +-- |
| 69 | +2.45.4 |
| 70 | + |
0 commit comments