Bugzilla – Bug 1039357
VUL-0: CVE-2017-1000366: glibc: Qualys new root/setuid privilege escalation method 05-2017
Last modified: 2018-03-20 15:46:03 UTC
As already discussed a bit with Marcus: the stack guard page size the kernel uses should be large enough to cater for the cases in which glibc uses alloca. Most alloca uses in glibc are meanwhile guarded by size checks (in which case they are bound by 64KB), and some others, as the initial comment explains, are implicitly guarded by other sizes (like MAX_ARG_STRLEN, then 128KB). All allocas in glibc should be guarded by explicit or implicit length checks, those that aren't should be made so (I don't think there are any left that aren't?). The kernel guard page size should be increased to cater for this, i.e. be made 128KB.
See comment #c1 on the bigger ones identified. To be very frank, we have been patching out "too large allocas" from glibc for several years now without knowing the actual impact and I fear there are likely more. This has to be fixed once and for all. So I see that building glibc and other libraries/programs with -fstack-check is the only solution to kill this bugclass.
This is already done in factory.
I do not see it in factory ... at least glibc is not build with -fstack-check according to the buildlog?
Sorry, mixed up with -fstack-protector.
CVE-2017-1000366 glibc stack/heap overflow (multiple vectors, multiple hardening to fix, not ideal but if needed we can SPLIT this more)
Embargo was changed to: CRD: 2017-06-19 That said, we need to consider an earlier leak of the information and have stuff prepared earlier.
Created attachment 726741 [details] 0001-rtld-Completely-ignore-LD_LIBRARY_PATH-for-AT_SECURE.patch 0001-rtld-Completely-ignore-LD_LIBRARY_PATH-for-AT_SECURE.patch from Florian Weimer
Created attachment 726742 [details] 0002-rtld-Reject-overly-long-LD_PRELOAD-path-elements.patch 0002-rtld-Reject-overly-long-LD_PRELOAD-path-elements.patch from florian weimer
Created attachment 726743 [details] 0003-rtld-Reject-overly-long-LD_AUDIT-path-elements.patch 0003-rtld-Reject-overly-long-LD_AUDIT-path-elements.patch from florian weimer
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2017-06-06. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/63642
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2017-06-07. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/63643
The issue is now public: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
SUSE-SU-2017:1611-1: An update that solves one vulnerability and has two fixes is now available. Category: security (important) Bug References: 1038690,1039357,987216 CVE References: CVE-2017-1000366 Sources used: SUSE Linux Enterprise Server for SAP 12 (src): glibc-2.19-22.21.1 SUSE Linux Enterprise Server 12-LTSS (src): glibc-2.19-22.21.1
SUSE-SU-2017:1614-1: An update that solves one vulnerability and has two fixes is now available. Category: security (important) Bug References: 1038690,1039357,986858 CVE References: CVE-2017-1000366 Sources used: SUSE OpenStack Cloud 6 (src): glibc-2.19-40.6.1 SUSE Linux Enterprise Server for SAP 12-SP1 (src): glibc-2.19-40.6.1 SUSE Linux Enterprise Server 12-SP1-LTSS (src): glibc-2.19-40.6.1
SUSE-SU-2017:1619-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1039357,1040043 CVE References: CVE-2017-1000366 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP2 (src): glibc-2.22-61.3 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): glibc-2.22-61.3 SUSE Linux Enterprise Server 12-SP2 (src): glibc-2.22-61.3 SUSE Linux Enterprise Desktop 12-SP2 (src): glibc-2.22-61.3 OpenStack Cloud Magnum Orchestration 7 (src): glibc-2.22-61.3
SUSE-SU-2017:1621-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1039357 CVE References: CVE-2017-1000366 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): glibc-2.11.3-17.109.1 SUSE Linux Enterprise Server 11-SP4 (src): glibc-2.11.3-17.109.1 SUSE Linux Enterprise Server 11-SP3-LTSS (src): glibc-2.11.3-17.109.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): glibc-2.11.3-17.109.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): glibc-2.11.3-17.109.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): glibc-2.11.3-17.109.1
openSUSE-SU-2017:1629-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1039357,1040043 CVE References: CVE-2017-1000366 Sources used: openSUSE Leap 42.2 (src): glibc-2.22-4.9.1, glibc-testsuite-2.22-4.9.2, glibc-utils-2.22-4.9.1
all released