Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package glibc for openSUSE:Factory checked
in at 2021-06-15 16:36:44
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/glibc (Old)
and /work/SRC/openSUSE:Factory/.glibc.new.32437 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "glibc"
Tue Jun 15 16:36:44 2021 rev:251 rq:899091 version:2.33
Changes:
--------
--- /work/SRC/openSUSE:Factory/glibc/glibc.changes 2021-06-02
22:10:42.764126639 +0200
+++ /work/SRC/openSUSE:Factory/.glibc.new.32437/glibc.changes 2021-06-15
16:36:53.253646783 +0200
@@ -1,0 +2,7 @@
+Thu Jun 10 13:24:39 UTC 2021 - Andreas Schwab <sch...@suse.de>
+
+- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
+ (CVE-2021-33574, bsc#1186489, BZ #27896)
+- Drop glibc-usrmerge-bootstrap-helper package
+
+-------------------------------------------------------------------
New:
----
mq-notify-use-after-free.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ glibc.spec ++++++
--- /var/tmp/diff_new_pack.Yp2vxj/_old 2021-06-15 16:36:56.397652228 +0200
+++ /var/tmp/diff_new_pack.Yp2vxj/_new 2021-06-15 16:36:56.401652235 +0200
@@ -180,9 +180,6 @@
Requires(pre): filesystem
Recommends: glibc-extra
Provides: rtld(GNU_HASH)
-%if %{with usrmerged}
-Provides: /sbin/ldconfig
-%endif
%endif
%if %{build_utils}
Requires: glibc = %{version}
@@ -263,6 +260,8 @@
Patch1007: rawmemchr-warning.patch
# PATCH-FIX-UPSTREAM: x86: tst-cpu-features-supports.c: Update AMX check
Patch1008: tst-cpu-features-amx.patch
+# PATCH-FIX-UPSTREAM: Use __pthread_attr_copy in mq_notify (CVE-2021-33574, BZ
#27896)
+Patch1009: mq-notify-use-after-free.patch
###
# Patches awaiting upstream approval
@@ -447,15 +446,6 @@
makedb: A program to create a database for nss
-%package usrmerge-bootstrap-helper
-Summary: Internal usrmerge bootstrap helper
-License: LGPL-2.1-or-later
-Requires: glibc = %{version}
-Requires: this-is-only-for-build-envs
-
-%description usrmerge-bootstrap-helper
-Internal usrmerge bootstrap helper
-
%lang_package
%endif
@@ -489,6 +479,7 @@
%patch1006 -p1
%patch1007 -p1
%patch1008 -p1
+%patch1009 -p1
%patch2000 -p1
%patch2001 -p1
@@ -956,20 +947,6 @@
%endif
rm %{buildroot}/sbin
-%if %{build_main}
-mkdir -p %{buildroot}/%{_lib}
-cp %{buildroot}%{slibdir}/libc.so.6 %{buildroot}/%{_lib}
-mkdir -p %{buildroot}/%{rtldlib}
-cp %{buildroot}%{rtlddir}/%{rtld_name} %{buildroot}/%{rtldlib}
-mkdir -p %{buildroot}/sbin
-cp %{buildroot}%{rootsbindir}/ldconfig %{buildroot}/sbin
-strip %{buildroot}/%{_lib}/libc.so.6 %{buildroot}/%{rtldlib}/%{rtld_name}
-strip %{buildroot}/sbin/ldconfig
-%ifarch riscv64
-ln -s . %{buildroot}/%{_lib}/lp64d
-%endif
-%endif
-
%endif
%endif
@@ -1292,17 +1269,6 @@
%files lang -f libc.lang
%endif
-%if %{with usrmerged}
-%files usrmerge-bootstrap-helper
-%defattr(-,root,root)
-/sbin/ldconfig
-/%{_lib}/libc.so.6
-/%{rtldlib}/%{rtld_name}
-%ifarch riscv64
-/%{_lib}/lp64d
-%endif
-%endif
-
%endif
%if %{build_utils}
++++++ _constraints ++++++
--- /var/tmp/diff_new_pack.Yp2vxj/_old 2021-06-15 16:36:56.433652290 +0200
+++ /var/tmp/diff_new_pack.Yp2vxj/_new 2021-06-15 16:36:56.437652297 +0200
@@ -6,7 +6,7 @@
</conditions>
<hardware>
<memory>
- <size unit="M">1500</size>
+ <size unit="M">2500</size>
</memory>
<disk>
<size unit="M">5600</size>
++++++ mq-notify-use-after-free.patch ++++++
>From 42d359350510506b87101cf77202fefcbfc790cb Mon Sep 17 00:00:00 2001
From: Andreas Schwab <sch...@linux-m68k.org>
Date: Thu, 27 May 2021 12:49:47 +0200
Subject: [PATCH 1/2] Use __pthread_attr_copy in mq_notify (bug 27896)
Make a deep copy of the pthread attribute object to remove a potential
use-after-free issue.
CVE-2021-33574: The mq_notify function has a potential use-after-free
issue when using a notification type of SIGEV_THREAD and a thread
attribute with a non-default affinity mask.
diff --git a/sysdeps/unix/sysv/linux/mq_notify.c
b/sysdeps/unix/sysv/linux/mq_notify.c
index cc575a0cdd..f7ddfe5a6c 100644
--- a/sysdeps/unix/sysv/linux/mq_notify.c
+++ b/sysdeps/unix/sysv/linux/mq_notify.c
@@ -133,8 +133,11 @@ helper_thread (void *arg)
(void) __pthread_barrier_wait (¬ify_barrier);
}
else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED)
- /* The only state we keep is the copy of the thread attributes. */
- free (data.attr);
+ {
+ /* The only state we keep is the copy of the thread attributes. */
+ pthread_attr_destroy (data.attr);
+ free (data.attr);
+ }
}
return NULL;
}
@@ -255,8 +258,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
if (data.attr == NULL)
return -1;
- memcpy (data.attr, notification->sigev_notify_attributes,
- sizeof (pthread_attr_t));
+ __pthread_attr_copy (data.attr, notification->sigev_notify_attributes);
}
/* Construct the new request. */
@@ -270,7 +272,10 @@ mq_notify (mqd_t mqdes, const struct sigevent
*notification)
/* If it failed, free the allocated memory. */
if (__glibc_unlikely (retval != 0))
- free (data.attr);
+ {
+ pthread_attr_destroy (data.attr);
+ free (data.attr);
+ }
return retval;
}
--
2.31.1
>From 217b6dc298156bdb0d6aea9ea93e7e394a5ff091 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fwei...@redhat.com>
Date: Tue, 1 Jun 2021 17:51:41 +0200
Subject: [PATCH 2/2] Fix use of __pthread_attr_copy in mq_notify (bug 27896)
__pthread_attr_copy can fail and does not initialize the attribute
structure in that case.
If __pthread_attr_copy is never called and there is no allocated
attribute, pthread_attr_destroy should not be called, otherwise
there is a null pointer dereference in rt/tst-mqueue6.
Fixes commit 42d359350510506b87101cf77202fefcbfc790cb
("Use __pthread_attr_copy in mq_notify (bug 27896)").
Reviewed-by: Siddhesh Poyarekar <siddh...@sourceware.org>
---
sysdeps/unix/sysv/linux/mq_notify.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/sysdeps/unix/sysv/linux/mq_notify.c
b/sysdeps/unix/sysv/linux/mq_notify.c
index f7ddfe5a6c..6f46d29d1d 100644
--- a/sysdeps/unix/sysv/linux/mq_notify.c
+++ b/sysdeps/unix/sysv/linux/mq_notify.c
@@ -258,7 +258,14 @@ mq_notify (mqd_t mqdes, const struct sigevent
*notification)
if (data.attr == NULL)
return -1;
- __pthread_attr_copy (data.attr, notification->sigev_notify_attributes);
+ int ret = __pthread_attr_copy (data.attr,
+ notification->sigev_notify_attributes);
+ if (ret != 0)
+ {
+ free (data.attr);
+ __set_errno (ret);
+ return -1;
+ }
}
/* Construct the new request. */
@@ -271,7 +278,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
int retval = INLINE_SYSCALL (mq_notify, 2, mqdes, &se);
/* If it failed, free the allocated memory. */
- if (__glibc_unlikely (retval != 0))
+ if (retval != 0 && data.attr != NULL)
{
pthread_attr_destroy (data.attr);
free (data.attr);
--
2.31.1
