diff options
| author | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2017-06-20 06:05:02 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2017-06-20 06:05:02 +0200 |
| commit | 0578ef88fd6ea9bd0039ab8cbcbc9a964e3b9969 (patch) | |
| tree | 21071d6ebf095da1ac0106485caee11b2d5dcfb4 | |
| parent | 2febff860b31df3666bef5ade0d0744c93f76a74 (diff) | |
| download | glibc-0578ef88fd6ea9bd0039ab8cbcbc9a964e3b9969.tar.gz | |
Ignore and remove LD_HWCAP_MASK for AT_SECURE programs (bug #21209)
The LD_HWCAP_MASK environment variable may alter the selection of
function variants for some architectures. For AT_SECURE process it
means that if an outdated routine has a bug that would otherwise not
affect newer platforms by default, LD_HWCAP_MASK will allow that bug
to be exploited.
To be on the safe side, ignore and disable LD_HWCAP_MASK for setuid
binaries.
[BZ #21209]
* elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for
AT_SECURE processes.
* sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK.
(cherry picked from commit 1c1243b6fc33c029488add276e56570a07803bfd)
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | elf/rtld.c | 3 | ||||
| -rw-r--r-- | sysdeps/generic/unsecvars.h | 1 |
4 files changed, 11 insertions, 1 deletions
@@ -1,3 +1,10 @@ +2017-03-07 Siddhesh Poyarekar <siddhesh@sourceware.org> + + [BZ #21209] + * elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for + AT_SECURE processes. + * sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK. + 2017-06-19 Florian Weimer <fweimer@redhat.com> * elf/rtld.c (audit_list_string): New variable. @@ -23,6 +23,7 @@ Security related changes: The following bugs are resolved with this release: + [21209] Ignore and remove LD_HWCAP_MASK for AT_SECURE programs [21289] Fix symbol redirect for fts_set [21386] Assertion in fork for distinct parent PID is incorrect [21624] Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366) diff --git a/elf/rtld.c b/elf/rtld.c index 302bb63620..8f56d6edd3 100644 --- a/elf/rtld.c +++ b/elf/rtld.c @@ -2553,7 +2553,8 @@ process_envvars (enum mode *modep) case 10: /* Mask for the important hardware capabilities. */ - if (memcmp (envline, "HWCAP_MASK", 10) == 0) + if (!__libc_enable_secure + && memcmp (envline, "HWCAP_MASK", 10) == 0) GLRO(dl_hwcap_mask) = __strtoul_internal (&envline[11], NULL, 0, 0); break; diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h index 3e56538b51..ac57bd5db0 100644 --- a/sysdeps/generic/unsecvars.h +++ b/sysdeps/generic/unsecvars.h @@ -10,6 +10,7 @@ "LD_DEBUG\0" \ "LD_DEBUG_OUTPUT\0" \ "LD_DYNAMIC_WEAK\0" \ + "LD_HWCAP_MASK\0" \ "LD_LIBRARY_PATH\0" \ "LD_ORIGIN_PATH\0" \ "LD_PRELOAD\0" \ |