summaryrefslogtreecommitdiffstats
path: root/patches/source/glibc/glibc.CVE-2017-1000366.3c7cd212.diff
diff options
context:
space:
mode:
Diffstat (limited to 'patches/source/glibc/glibc.CVE-2017-1000366.3c7cd212.diff')
-rw-r--r--patches/source/glibc/glibc.CVE-2017-1000366.3c7cd212.diff32
1 files changed, 32 insertions, 0 deletions
diff --git a/patches/source/glibc/glibc.CVE-2017-1000366.3c7cd212.diff b/patches/source/glibc/glibc.CVE-2017-1000366.3c7cd212.diff
new file mode 100644
index 000000000..ee2870bc8
--- /dev/null
+++ b/patches/source/glibc/glibc.CVE-2017-1000366.3c7cd212.diff
@@ -0,0 +1,32 @@
+From 3c7cd21290cabdadd72984fb69bc51e64ff1002d Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Mon, 19 Jun 2017 18:31:27 +0200
+Subject: [PATCH] CVE-2017-1000366: Ignore LD_LIBRARY_PATH for AT_SECURE=1
+ programs [BZ #21624]
+
+LD_LIBRARY_PATH can only be used to reorder system search paths, which
+is not useful functionality.
+
+This makes an exploitable unbounded alloca in _dl_init_paths unreachable
+for AT_SECURE=1 programs.
+
+(cherry picked from commit f6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d)
+
+diff --git a/elf/rtld.c b/elf/rtld.c
+index a036ece..2fc33a6 100644
+--- a/elf/rtld.c
++++ b/elf/rtld.c
+@@ -2418,7 +2418,8 @@ process_envvars (enum mode *modep)
+
+ case 12:
+ /* The library search path. */
+- if (memcmp (envline, "LIBRARY_PATH", 12) == 0)
++ if (!__libc_enable_secure
++ && memcmp (envline, "LIBRARY_PATH", 12) == 0)
+ {
+ library_path = &envline[13];
+ break;
+--
+2.9.3
+
+