--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: security
User: release.debian....@packages.debian.org
Usertags: unblock
X-Debbugs-Cc: gl...@packages.debian.org
Control: affects -1 + src:glibc
[ Reason ]
glibc/2.37-12 fixes a local root vulnerability, I believe the package
should migrate as soon as the possible in testing, bypassing the debci
tests.
[ Impact ]
Users of testing will be left with a local root vulnerability.
[ Tests ]
The testsuite has been updated to check for the security issue. In
addition manual testing has been done to confirm the security
vulnerability has been fixed.
[ Risks ]
The diff between glibc/2.37-11 and glibc/2.37-12 are minimal, with the
exception of XFAILing a test on hurd-i386, and slightly adjusting the
allowed accuracy in the test of the y0_towardzero function.
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
[ Other info ]
Without packages with flaky autopkgtests, glibc/2.37-11 should have been
in testing for a few days already, so I have considered that version as
a basis for filling this unblock.
diff --git a/debian/changelog b/debian/changelog
index deca040f..c3f116c3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,16 @@
+glibc (2.37-12) unstable; urgency=critical
+
+ [ Samuel Thibault ]
+ * debian/testsuite-xfail-debian.mk: Update xfails for hurd-i386.
+
+ [ Aurelien Jarno ]
+ * debian/patches/git-updates.diff: update from upstream stable branch:
+ - Fix a buffer overflow in the dynamic loader's processing of the
+ GLIBC_TUNABLES environment variable (CVE-2023-4911).
+ * Set urgency to critical given the security issue.
+
+ -- Aurelien Jarno <aure...@debian.org> Tue, 03 Oct 2023 19:14:06 +0200
+
glibc (2.37-11) unstable; urgency=medium
[ Samuel Thibault ]
diff --git a/debian/patches/git-updates.diff b/debian/patches/git-updates.diff
index d8549680..ecaf3162 100644
--- a/debian/patches/git-updates.diff
+++ b/debian/patches/git-updates.diff
@@ -1,10 +1,10 @@
GIT update of https://sourceware.org/git/glibc.git/release/2.37/master from
glibc-2.37
diff --git a/NEWS b/NEWS
-index ad5196a5f1..3725cc4820 100644
+index ad5196a5f1..b351537a78 100644
--- a/NEWS
+++ b/NEWS
-@@ -5,6 +5,50 @@ See the end for copying conditions.
+@@ -5,6 +5,55 @@ See the end for copying conditions.
Please send GNU C library bug reports via <https://sourceware.org/bugzilla/>
using `glibc' in the "product" field.
@@ -34,6 +34,11 @@ index ad5196a5f1..3725cc4820 100644
+ an application calls getaddrinfo for AF_INET6 with AI_CANONNAME,
+ AI_ALL and AI_V4MAPPED flags set.
+
++ CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the
++ environment of a setuid program and NAME is valid, it may result in a
++ buffer overflow, which could be exploited to achieve escalated
++ privileges. This flaw was introduced in glibc 2.34.
++
+The following bugs are resolved with this release:
+
+ [20975] Deferred cancellation triggers in __check_pf and looses lock
leading to deadlock
@@ -55,7 +60,7 @@ index ad5196a5f1..3725cc4820 100644
Version 2.37
Major new features:
-@@ -105,6 +149,8 @@ The following bugs are resolved with this release:
+@@ -105,6 +154,8 @@ The following bugs are resolved with this release:
coincides with offset change
[30039] stdio: __vsprintf_internal does not handle unspecified buffer
length in fortify mode
@@ -638,6 +643,42 @@ index d35a725415..32a8bfcf74 100644
#endif
/* Store the result for later runs. */
+diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c
+index 327b9eb52f..985b69c180 100644
+--- a/elf/dl-tunables.c
++++ b/elf/dl-tunables.c
+@@ -187,11 +187,7 @@ parse_tunables (char *tunestr, char *valstring)
+ /* If we reach the end of the string before getting a valid name-value
+ pair, bail out. */
+ if (p[len] == '\0')
+- {
+- if (__libc_enable_secure)
+- tunestr[off] = '\0';
+- return;
+- }
++ break;
+
+ /* We did not find a valid name-value pair before encountering the
+ colon. */
+@@ -251,9 +247,16 @@ parse_tunables (char *tunestr, char *valstring)
+ }
+ }
+
+- if (p[len] != '\0')
+- p += len + 1;
++ /* We reached the end while processing the tunable string. */
++ if (p[len] == '\0')
++ break;
++
++ p += len + 1;
+ }
++
++ /* Terminate tunestr before we leave. */
++ if (__libc_enable_secure)
++ tunestr[off] = '\0';
+ }
+ #endif
+
diff --git a/elf/dl-tunables.list b/elf/dl-tunables.list
index a685f5cdbc..695ba7192e 100644
--- a/elf/dl-tunables.list
@@ -999,6 +1040,97 @@ index f6ab991398..f6dfbbe202 100644
/* Verify that dlmopen creates a new namespace. */
void *dlmopen_handle = xdlmopen (LM_ID_NEWLM, LIBC_SO, RTLD_NOW);
TEST_VERIFY (dlmopen_handle != handle);
+diff --git a/elf/tst-env-setuid-tunables.c b/elf/tst-env-setuid-tunables.c
+index 807b426012..1f5e7f4f06 100644
+--- a/elf/tst-env-setuid-tunables.c
++++ b/elf/tst-env-setuid-tunables.c
+@@ -52,6 +52,8 @@ const char *teststrings[] =
+
"glibc.malloc.perturb=0x800:not_valid.malloc.check=2:glibc.malloc.mmap_threshold=4096",
+ "glibc.not_valid.check=2:glibc.malloc.mmap_threshold=4096",
+ "not_valid.malloc.check=2:glibc.malloc.mmap_threshold=4096",
++ "glibc.malloc.mmap_threshold=glibc.malloc.mmap_threshold=4096",
++ "glibc.malloc.check=2",
+
"glibc.malloc.garbage=2:glibc.maoc.mmap_threshold=4096:glibc.malloc.check=2",
+
"glibc.malloc.check=4:glibc.malloc.garbage=2:glibc.maoc.mmap_threshold=4096",
+ ":glibc.malloc.garbage=2:glibc.malloc.check=1",
+@@ -70,6 +72,8 @@ const char *resultstrings[] =
+ "glibc.malloc.perturb=0x800:glibc.malloc.mmap_threshold=4096",
+ "glibc.malloc.mmap_threshold=4096",
+ "glibc.malloc.mmap_threshold=4096",
++ "glibc.malloc.mmap_threshold=glibc.malloc.mmap_threshold=4096",
++ "",
+ "",
+ "",
+ "",
+@@ -84,11 +88,18 @@ test_child (int off)
+ const char *val = getenv ("GLIBC_TUNABLES");
+
+ #if HAVE_TUNABLES
++ printf (" [%d] GLIBC_TUNABLES is %s\n", off, val);
++ fflush (stdout);
+ if (val != NULL && strcmp (val, resultstrings[off]) == 0)
+ return 0;
+
+ if (val != NULL)
+- printf ("[%d] Unexpected GLIBC_TUNABLES VALUE %s\n", off, val);
++ printf (" [%d] Unexpected GLIBC_TUNABLES VALUE %s, expected %s\n",
++ off, val, resultstrings[off]);
++ else
++ printf (" [%d] GLIBC_TUNABLES environment variable absent\n", off);
++
++ fflush (stdout);
+
+ return 1;
+ #else
+@@ -117,21 +128,26 @@ do_test (int argc, char **argv)
+ if (ret != 0)
+ exit (1);
+
+- exit (EXIT_SUCCESS);
++ /* Special return code to make sure that the child executed all the way
++ through. */
++ exit (42);
+ }
+ else
+ {
+- int ret = 0;
+-
+ /* Spawn tests. */
+ for (int i = 0; i < array_length (teststrings); i++)
+ {
+ char buf[INT_BUFSIZE_BOUND (int)];
+
+- printf ("Spawned test for %s (%d)\n", teststrings[i], i);
++ printf ("[%d] Spawned test for %s\n", i, teststrings[i]);
+ snprintf (buf, sizeof (buf), "%d\n", i);
++ fflush (stdout);
+ if (setenv ("GLIBC_TUNABLES", teststrings[i], 1) != 0)
+- exit (1);
++ {
++ printf (" [%d] Failed to set GLIBC_TUNABLES: %m", i);
++ support_record_failure ();
++ continue;
++ }
+
+ int status = support_capture_subprogram_self_sgid (buf);
+
+@@ -139,9 +155,14 @@ do_test (int argc, char **argv)
+ if (WEXITSTATUS (status) == EXIT_UNSUPPORTED)
+ return EXIT_UNSUPPORTED;
+
+- ret |= status;
++ if (WEXITSTATUS (status) != 42)
++ {
++ printf (" [%d] child failed with status %d\n", i,
++ WEXITSTATUS (status));
++ support_record_failure ();
++ }
+ }
+- return ret;
++ return 0;
+ }
+ }
+
diff --git a/elf/tst-ldconfig-p.sh b/elf/tst-ldconfig-p.sh
new file mode 100644
index 0000000000..ec937bf4ec
@@ -2982,6 +3114,19 @@ index 66b3ff9763..28daf3f89b 100644
-#define DL_FIXUP_BINDNOW_RELOC(value, new_value, st_value) \
+#define DL_FIXUP_BINDNOW_RELOC(l, reloc, value, new_value, st_value, lazy) \
*(value) = *(DL_FIXUP_VALUE_TYPE *) ((uintptr_t) (new_value) & ~2)
+diff --git a/sysdeps/i386/i686/fpu/multiarch/libm-test-ulps
b/sysdeps/i386/i686/fpu/multiarch/libm-test-ulps
+index 8705a7822c..6f50cec761 100644
+--- a/sysdeps/i386/i686/fpu/multiarch/libm-test-ulps
++++ b/sysdeps/i386/i686/fpu/multiarch/libm-test-ulps
+@@ -1617,7 +1617,7 @@ ldouble: 5
+
+ Function: "y0_towardzero":
+ double: 4
+-float: 8
++float: 9
+ float128: 3
+ ldouble: 8
+
diff --git a/sysdeps/ia64/dl-lookupcfg.h b/sysdeps/ia64/dl-lookupcfg.h
index 0e47e529fe..64218fa7bb 100644
--- a/sysdeps/ia64/dl-lookupcfg.h
diff --git a/debian/testsuite-xfail-debian.mk b/debian/testsuite-xfail-debian.mk
index 51217bc6..718daa30 100644
--- a/debian/testsuite-xfail-debian.mk
+++ b/debian/testsuite-xfail-debian.mk
@@ -375,6 +375,7 @@ test-xfail-tst-nss-gai-actions = yes
# new in 2.37
test-xfail-tst-fcntl-lock = yes
test-xfail-tst-fcntl-lock-lfs = yes
+test-xfail-tst-nss-gai-hv2-canonname = yes
# missing RLIMIT_AS support
test-xfail-tst-vfprintf-width-prec-mem = yes
--- End Message ---
OpenPGP_signature.asc
