From a38af3c3909cba90fcef973b2c0c3a6aa82a9ef0 Mon Sep 17 00:00:00 2001 From: Yuanjie Huang Date: Mon, 19 Jun 2017 00:33:03 -0700 Subject: [PATCH] glibc-2.11: Preliminary fix to CVE-2017-1000366 Squashed commit of the following: commit c55349631e60dc6c1168a5eef33e9a71797c3d72 Author: Siddhesh Poyarekar Date: Tue Mar 7 20:52:04 2017 +0530 glibc: Ignore and remove LD_HWCAP_MASK for AT_SECURE programs (bug #21209) The LD_HWCAP_MASK environment variable may alter the selection of function variants for some architectures. For AT_SECURE process it means that if an outdated routine has a bug that would otherwise not affect newer platforms by default, LD_HWCAP_MASK will allow that bug to be exploited. To be on the safe side, ignore and disable LD_HWCAP_MASK for setuid binaries. [BZ #21209] * elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for AT_SECURE processes. * sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK. (cherry picked from commit 1c1243b6fc33c029488add276e56570a07803bfd) Upstream-Status: Backport[master] CVE: CVE-2017-100366 Signed-off-by: Yuanjie Huang commit c936cbdc84e43a8e3aea27775d5fac0976d6a5c6 Author: Florian Weimer Date: Sun May 28 20:44:52 2017 +0200 glibc: rtld: Reject overly long LD_AUDIT path elements Also only process the last LD_AUDIT entry. Upstream-Status: Pending CVE: CVE-2017-100366 Signed-off-by: Yuanjie Huang commit 9d877097b77bc2a97ae5da3ca573d1fb0933139c Author: Florian Weimer Date: Sun May 28 20:57:40 2017 +0200 glibc: rtld: Reject overly long LD_PRELOAD path elements Upstream-Status: Pending CVE: CVE-2017-100366 Signed-off-by: Yuanjie Huang commit ef188c2d969bc406c66f0bf59c4f283dc8b37a21 Author: Florian Weimer Date: Sun May 28 20:37:40 2017 +0200 glibc: rtld: Completely ignore LD_LIBRARY_PATH for AT_SECURE=1 programs LD_LIBRARY_PATH can only be used to reorder system search paths, which is not useful functionality. Upstream-Status: Pending CVE: CVE-2017-100366 Signed-off-by: Yuanjie Huang Signed-off-by: Yuanjie Huang --- glibc-2.11-wrs/elf/rtld.c | 185 ++++++++++++++++++++++++----- glibc-2.11-wrs/sysdeps/generic/unsecvars.h | 1 + 2 files changed, 153 insertions(+), 33 deletions(-) diff --git a/glibc-2.11-wrs/elf/rtld.c b/glibc-2.11-wrs/elf/rtld.c index 0cf2cc9..d88604d 100644 --- a/glibc-2.11-wrs/elf/rtld.c +++ b/glibc-2.11-wrs/elf/rtld.c @@ -98,14 +98,108 @@ uintptr_t __pointer_chk_guard_local strong_alias (__pointer_chk_guard_local, __pointer_chk_guard) #endif +/* Check that AT_SECURE=0, or that the passed name does not contain + directories and is not overly long. Reject empty names + unconditionally. */ +static bool +dso_name_valid_for_suid (const char *p) +{ + if (__builtin_expect (INTUSE(__libc_enable_secure), 0)) + { + /* Ignore pathnames with directories for AT_SECURE=1 + programs, and also skip overlong names. */ + size_t len = strlen (p); + if (len >= NAME_MAX || memchr (p, '/', len) != NULL) + return false; + } + return *p != '\0'; +} + +/* LD_AUDIT variable contents. Must be processed before the + audit_list below. */ +const char *audit_list_string; -/* List of auditing DSOs. */ +/* Cyclic list of auditing DSOs. audit_list->next is the first + element. */ static struct audit_list { const char *name; struct audit_list *next; } *audit_list; +/* Iterator for audit_list_string followed by audit_list. */ +struct audit_list_iter +{ + /* Tail of audit_list_string still needing processing, or NULL. */ + const char *audit_list_tail; + + /* The list element returned in the previous iteration. NULL before + the first element. */ + struct audit_list *previous; + + /* Scratch buffer for returning a name which is part of + audit_list_string. */ + char fname[PATH_MAX]; +}; + +/* Initialize an audit list iterator. */ +static void +audit_list_iter_init (struct audit_list_iter *iter) +{ + iter->audit_list_tail = audit_list_string; + iter->previous = NULL; +} + +/* Iterate through both audit_list_string and audit_list. */ +static const char * +audit_list_iter_next (struct audit_list_iter *iter) +{ + if (iter->audit_list_tail != NULL) + { + /* First iterate over audit_list_string. */ + while (*iter->audit_list_tail != '\0') + { + /* Split audit list at colon. */ + size_t len = strcspn (iter->audit_list_tail, ":"); + if (len > 0 && len < PATH_MAX) + { + memcpy (iter->fname, iter->audit_list_tail, len); + iter->fname[len] = '\0'; + } + else + /* Do not return this name to the caller. */ + iter->fname[0] = '\0'; + + /* Skip over the substring and the following delimiter. */ + iter->audit_list_tail += len; + if (*iter->audit_list_tail == ':') + ++iter->audit_list_tail; + + /* If the name is valid, return it. */ + if (dso_name_valid_for_suid (iter->fname)) + return iter->fname; + /* Otherwise, wrap around and try the next name. */ + } + /* Fall through to the procesing of audit_list. */ + } + + if (iter->previous == NULL) + { + if (audit_list == NULL) + /* No pre-parsed audit list. */ + return NULL; + /* Start of audit list. The first list element is at + audit_list->next (cyclic list). */ + iter->previous = audit_list->next; + return iter->previous->name; + } + if (iter->previous == audit_list) + /* Cyclic list wrap-around. */ + return NULL; + iter->previous = iter->previous->next; + return iter->previous->name; +} + #ifndef HAVE_INLINED_SYSCALLS /* Set nonzero during loading and initialization of executable and libraries, cleared before the executable's entry point runs. This @@ -878,6 +972,42 @@ static const char *preloadlist attribute_relro; /* Nonzero if information about versions has to be printed. */ static int version_info attribute_relro; +/* The LD_PRELOAD environment variable gives list of libraries + separated by white space or colons that are loaded before the + executable's dependencies and prepended to the global scope list. + (If the binary is running setuid all elements containing a '/' are + ignored since it is insecure.) Return the number of preloads + performed. */ +unsigned int +handle_ld_preload (const char *preloadlist, struct link_map *main_map) +{ + unsigned int npreloads = 0; + const char *p = preloadlist; + char fname[PATH_MAX]; + + while (*p != '\0') + { + /* Split preload list at space/colon. */ + size_t len = strcspn (p, " :"); + if (len > 0 && len < PATH_MAX) + { + memcpy (fname, p, len); + fname[len] = '\0'; + } + else + fname[0] = '\0'; + + /* Skip over the substring and the following delimiter. */ + p += len; + if (*p == ' ' || *p == ':') + ++p; + + if (dso_name_valid_for_suid (fname)) + npreloads += do_preload (fname, main_map, "LD_PRELOAD"); + } + return npreloads; +} + static void dl_main (const ElfW(Phdr) *phdr, ElfW(Word) phnum, @@ -1434,11 +1564,13 @@ of this helper program; chances are you did not intend to run this program.\n\ GL(dl_rtld_map).l_tls_modid = _dl_next_tls_modid (); /* If we have auditing DSOs to load, do it now. */ - if (__builtin_expect (audit_list != NULL, 0)) + bool need_security_init = true; + if (__builtin_expect (audit_list != NULL, 0) + || __builtin_expect (audit_list_string != NULL, 0)) { - /* Iterate over all entries in the list. The order is important. */ struct audit_ifaces *last_audit = NULL; - struct audit_list *al = audit_list->next; + struct audit_list_iter al_iter; + audit_list_iter_init (&al_iter); /* Since we start using the auditing DSOs right away we need to initialize the data structures now. */ @@ -1449,9 +1581,14 @@ of this helper program; chances are you did not intend to run this program.\n\ use different values (especially the pointer guard) and will fail later on. */ security_init (); + need_security_init = false; - do + while (true) { + const char *name = audit_list_iter_next (&al_iter); + if (name == NULL) + break; + int tls_idx = GL(dl_tls_max_dtv_idx); /* Now it is time to determine the layout of the static TLS @@ -1460,7 +1597,7 @@ of this helper program; chances are you did not intend to run this program.\n\ no DF_STATIC_TLS bit is set. The reason is that we know glibc will use the static model. */ struct dlmopen_args dlmargs; - dlmargs.fname = al->name; + dlmargs.fname = name; dlmargs.map = NULL; const char *objname; @@ -1473,7 +1610,7 @@ of this helper program; chances are you did not intend to run this program.\n\ not_loaded: _dl_error_printf ("\ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n", - al->name, err_str); + name, err_str); if (malloced) free ((char *) err_str); } @@ -1577,10 +1714,7 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n", goto not_loaded; } } - - al = al->next; } - while (al != audit_list->next); /* If we have any auditing modules, announce that we already have two objects loaded. */ @@ -1653,23 +1787,8 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n", if (__builtin_expect (preloadlist != NULL, 0)) { - /* The LD_PRELOAD environment variable gives list of libraries - separated by white space or colons that are loaded before the - executable's dependencies and prepended to the global scope - list. If the binary is running setuid all elements - containing a '/' are ignored since it is insecure. */ - char *list = strdupa (preloadlist); - char *p; - HP_TIMING_NOW (start); - - /* Prevent optimizing strsep. Speed is not important here. */ - while ((p = (strsep) (&list, " :")) != NULL) - if (p[0] != '\0' - && (__builtin_expect (! INTUSE(__libc_enable_secure), 1) - || strchr (p, '/') == NULL)) - npreloads += do_preload (p, main_map, "LD_PRELOAD"); - + npreloads += handle_ld_preload (preloadlist, main_map); HP_TIMING_NOW (stop); HP_TIMING_DIFF (diff, start, stop); HP_TIMING_ACCUM_NT (load_time, diff); @@ -1854,7 +1973,7 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n", if (tcbp == NULL) tcbp = init_tls (); - if (__builtin_expect (audit_list == NULL, 1)) + if (__builtin_expect (need_security_init, 1)) /* Initialize security features. But only if we have not done it earlier. */ security_init (); @@ -2466,9 +2585,7 @@ process_dl_audit (char *str) char *p; while ((p = (strsep) (&str, ":")) != NULL) - if (p[0] != '\0' - && (__builtin_expect (! INTUSE(__libc_enable_secure), 1) - || strchr (p, '/') == NULL)) + if (dso_name_valid_for_suid (p)) { /* This is using the local malloc, not the system malloc. The memory can never be freed. */ @@ -2532,7 +2649,7 @@ process_envvars (enum mode *modep) break; } if (memcmp (envline, "AUDIT", 5) == 0) - process_dl_audit (&envline[6]); + audit_list_string = &envline[6]; break; case 7: @@ -2576,7 +2693,8 @@ process_envvars (enum mode *modep) case 10: /* Mask for the important hardware capabilities. */ - if (memcmp (envline, "HWCAP_MASK", 10) == 0) + if (!INTUSE(__libc_enable_secure) + && memcmp (envline, "HWCAP_MASK", 10) == 0) GLRO(dl_hwcap_mask) = __strtoul_internal (&envline[11], NULL, 0, 0); break; @@ -2590,7 +2708,8 @@ process_envvars (enum mode *modep) case 12: /* The library search path. */ - if (memcmp (envline, "LIBRARY_PATH", 12) == 0) + if (!INTUSE(__libc_enable_secure) + && memcmp (envline, "LIBRARY_PATH", 12) == 0) { library_path = &envline[13]; break; diff --git a/glibc-2.11-wrs/sysdeps/generic/unsecvars.h b/glibc-2.11-wrs/sysdeps/generic/unsecvars.h index d5b8119..358dfb3 100644 --- a/glibc-2.11-wrs/sysdeps/generic/unsecvars.h +++ b/glibc-2.11-wrs/sysdeps/generic/unsecvars.h @@ -9,6 +9,7 @@ "LD_DEBUG\0" \ "LD_DEBUG_OUTPUT\0" \ "LD_DYNAMIC_WEAK\0" \ + "LD_HWCAP_MASK\0" \ "LD_LIBRARY_PATH\0" \ "LD_ORIGIN_PATH\0" \ "LD_PRELOAD\0" \ -- 1.8.5.6