* [PATCH 1/5] glibc: Fix CVE-2015-8778
2016-05-11 3:07 [PATCH 0/5] [jethro] Consolidated pull Robert Yang
@ 2016-05-11 3:07 ` Robert Yang
2016-05-11 3:07 ` [PATCH 2/5] binutils: backport bug fix to the 2.25 branch for jethro Robert Yang
` (3 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: Robert Yang @ 2016-05-11 3:07 UTC (permalink / raw)
To: openembedded-core
From: Yuanjie Huang <yuanjie.huang@windriver.com>
CVE: CVE-2015-8778
Improve check against integer wraparound in hcreate_r [BZ #18240]
This is an integer overflow in hcreate and hcreate_r which can result in
an out-of-bound memory access. This could lead to application crashes
or, potentially, arbitrary code execution.
Upstream-Status: Backport [2.23]
(cherry-picked from commit bae7c7c7, 4bd228c8)
Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
---
meta/recipes-core/glibc/glibc/CVE-2015-8778.patch | 199 ++++++++++++++++++++++
meta/recipes-core/glibc/glibc_2.22.bb | 1 +
2 files changed, 200 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/CVE-2015-8778.patch
diff --git a/meta/recipes-core/glibc/glibc/CVE-2015-8778.patch b/meta/recipes-core/glibc/glibc/CVE-2015-8778.patch
new file mode 100644
index 0000000..c505c10
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/CVE-2015-8778.patch
@@ -0,0 +1,199 @@
+From d0f05d1e39adb336a8bbccbc276a344e6ff427e3 Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Thu, 28 Jan 2016 13:59:11 +0100
+Subject: [PATCH] Improve check against integer wraparound in hcreate_r [BZ
+ #18240]
+
+CVE: CVE-2015-8778
+
+Improve check against integer wraparound in hcreate_r [BZ #18240]
+
+This is an integer overflow in hcreate and hcreate_r which can result in
+an out-of-bound memory access. This could lead to application crashes
+or, potentially, arbitrary code execution.
+
+Upstream-Status: Backport [2.23]
+(cherry-picked from commit bae7c7c7, 4bd228c8)
+
+Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
+---
+ ChangeLog | 6 +++++
+ NEWS | 2 +-
+ misc/Makefile | 2 +-
+ misc/bug18240.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ misc/hsearch_r.c | 28 ++++++++++++---------
+ 5 files changed, 100 insertions(+), 13 deletions(-)
+ create mode 100644 misc/bug18240.c
+
+diff --git a/ChangeLog b/ChangeLog
+index b7701d1..a9dc8a2 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,9 @@
++2016-01-27 Paul Eggert <eggert@cs.ucla.edu>
++
++ [BZ #18240]
++ * misc/hsearch_r.c (isprime, __hcreate_r): Protect against
++ unsigned int wraparound.
++
+ 2016-02-15 Carlos O'Donell <carlos@redhat.com>
+
+ [BZ #18665]
+diff --git a/NEWS b/NEWS
+index cda7a73..fd77c27 100644
+--- a/NEWS
++++ b/NEWS
+@@ -9,7 +9,7 @@ Version 2.22.1
+
+ * The following bugs are resolved with this release:
+
+- 18778, 18781, 18787, 17905.
++ 18240, 18778, 18781, 18787, 17905.
+ \f
+ Version 2.22
+
+diff --git a/misc/Makefile b/misc/Makefile
+index e6b7c23..463a238 100644
+--- a/misc/Makefile
++++ b/misc/Makefile
+@@ -83,7 +83,7 @@ install-lib := libg.a
+ gpl2lgpl := error.c error.h
+
+ tests := tst-dirname tst-tsearch tst-fdset tst-mntent tst-hsearch \
+- tst-pselect tst-insremque tst-mntent2 bug-hsearch1
++ tst-pselect tst-insremque tst-mntent2 bug-hsearch1 bug18240
+ tests-$(OPTION_POSIX_WIDE_CHAR_DEVICE_IO) += tst-error1
+ tests-$(OPTION_EGLIBC_FCVT) += tst-efgcvt
+ ifeq ($(run-built-tests),yes)
+diff --git a/misc/bug18240.c b/misc/bug18240.c
+new file mode 100644
+index 0000000..4b26865
+--- /dev/null
++++ b/misc/bug18240.c
+@@ -0,0 +1,75 @@
++/* Test integer wraparound in hcreate.
++ Copyright (C) 2016 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <http://www.gnu.org/licenses/>. */
++
++#include <errno.h>
++#include <limits.h>
++#include <search.h>
++#include <stdbool.h>
++#include <stdio.h>
++#include <stdlib.h>
++
++static void
++test_size (size_t size)
++{
++ int res = hcreate (size);
++ if (res == 0)
++ {
++ if (errno == ENOMEM)
++ return;
++ printf ("error: hcreate (%zu): %m\n", size);
++ exit (1);
++ }
++ char *keys[100];
++ for (int i = 0; i < 100; ++i)
++ {
++ if (asprintf (keys + i, "%d", i) < 0)
++ {
++ printf ("error: asprintf: %m\n");
++ exit (1);
++ }
++ ENTRY e = { keys[i], (char *) "value" };
++ if (hsearch (e, ENTER) == NULL)
++ {
++ printf ("error: hsearch (\"%s\"): %m\n", keys[i]);
++ exit (1);
++ }
++ }
++ hdestroy ();
++
++ for (int i = 0; i < 100; ++i)
++ free (keys[i]);
++}
++
++static int
++do_test (void)
++{
++ test_size (500);
++ test_size (-1);
++ test_size (-3);
++ test_size (INT_MAX - 2);
++ test_size (INT_MAX - 1);
++ test_size (INT_MAX);
++ test_size (((unsigned) INT_MAX) + 1);
++ test_size (UINT_MAX - 2);
++ test_size (UINT_MAX - 1);
++ test_size (UINT_MAX);
++ return 0;
++}
++
++#define TEST_FUNCTION do_test ()
++#include "../test-skeleton.c"
+diff --git a/misc/hsearch_r.c b/misc/hsearch_r.c
+index 9f55e84..6000ce2 100644
+--- a/misc/hsearch_r.c
++++ b/misc/hsearch_r.c
+@@ -46,15 +46,12 @@ static int
+ isprime (unsigned int number)
+ {
+ /* no even number will be passed */
+- unsigned int div = 3;
+-
+- while (div * div < number && number % div != 0)
+- div += 2;
+-
+- return number % div != 0;
++ for (unsigned int div = 3; div <= number / div; div += 2)
++ if (number % div == 0)
++ return 0;
++ return 1;
+ }
+
+-
+ /* Before using the hash table we must allocate memory for it.
+ Test for an existing table are done. We allocate one element
+ more as the found prime number says. This is done for more effective
+@@ -81,10 +78,19 @@ __hcreate_r (nel, htab)
+ use will not work. */
+ if (nel < 3)
+ nel = 3;
+- /* Change nel to the first prime number not smaller as nel. */
+- nel |= 1; /* make odd */
+- while (!isprime (nel))
+- nel += 2;
++
++ /* Change nel to the first prime number in the range [nel, UINT_MAX - 2],
++ The '- 2' means 'nel += 2' cannot overflow. */
++ for (nel |= 1; ; nel += 2)
++ {
++ if (UINT_MAX - 2 < nel)
++ {
++ __set_errno (ENOMEM);
++ return 0;
++ }
++ if (isprime (nel))
++ break;
++ }
+
+ htab->size = nel;
+ htab->filled = 0;
+--
+2.7.4
+
diff --git a/meta/recipes-core/glibc/glibc_2.22.bb b/meta/recipes-core/glibc/glibc_2.22.bb
index a13b7f9..7b25847 100644
--- a/meta/recipes-core/glibc/glibc_2.22.bb
+++ b/meta/recipes-core/glibc/glibc_2.22.bb
@@ -47,6 +47,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://CVE-2015-9761_2.patch \
file://CVE-2015-8776.patch \
file://CVE-2015-7547.patch \
+ file://CVE-2015-8778.patch \
"
SRC_URI += "\
--
2.8.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH 2/5] binutils: backport bug fix to the 2.25 branch for jethro
2016-05-11 3:07 [PATCH 0/5] [jethro] Consolidated pull Robert Yang
2016-05-11 3:07 ` [PATCH 1/5] glibc: Fix CVE-2015-8778 Robert Yang
@ 2016-05-11 3:07 ` Robert Yang
2016-05-11 3:07 ` [PATCH 3/5] gdb: fix QA warning (uClibc) Robert Yang
` (2 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: Robert Yang @ 2016-05-11 3:07 UTC (permalink / raw)
To: openembedded-core
From: Tristan Van Berkom <tristan.vanberkom@codethink.co.uk>
We fail to build webkit on aarch64 due to this binutils bug:
https://sourceware.org/bugzilla/show_bug.cgi?id=19353
Applying patch which fixes this, stripped out changelog entry
from patch to make it apply without error.
---
meta/recipes-devtools/binutils/binutils-2.25.1.inc | 1 +
...plying-TLSDESC-relocs-without-TLS-segment.patch | 166 +++++++++++++++++++++
2 files changed, 167 insertions(+)
create mode 100644 meta/recipes-devtools/binutils/binutils/fix-internal-error-when-applying-TLSDESC-relocs-without-TLS-segment.patch
diff --git a/meta/recipes-devtools/binutils/binutils-2.25.1.inc b/meta/recipes-devtools/binutils/binutils-2.25.1.inc
index f3817fa..c7db9e0 100644
--- a/meta/recipes-devtools/binutils/binutils-2.25.1.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.25.1.inc
@@ -35,6 +35,7 @@ SRC_URI = "\
file://0015-Fix-dynamic-list-so-that-symbols-not-in-the-list-are.patch \
file://binutils-octeon3.patch \
file://add-thunderx-support-for-gas.patch \
+ file://fix-internal-error-when-applying-TLSDESC-relocs-without-TLS-segment.patch \
"
S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/fix-internal-error-when-applying-TLSDESC-relocs-without-TLS-segment.patch b/meta/recipes-devtools/binutils/binutils/fix-internal-error-when-applying-TLSDESC-relocs-without-TLS-segment.patch
new file mode 100644
index 0000000..df9d54c
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/fix-internal-error-when-applying-TLSDESC-relocs-without-TLS-segment.patch
@@ -0,0 +1,166 @@
+From d21f123b0ead1806416cf0dafae12bec4cca8920 Mon Sep 17 00:00:00 2001
+From: Cary Coutant <ccoutant@gmail.com>
+Date: Mon, 11 Jan 2016 23:57:44 -0800
+Subject: [PATCH] Fix internal error when applying TLSDESC relocations with no TLS segment.
+
+gold/
+ PR gold/19353
+ * aarch64.cc (Target_aarch64::relocate_tls): Don't insist that
+ we have a TLS segment for GD-to-IE optimization.
+ * i386.cc (Target_i386::tls_gd_to_ie): Remove tls_segment parameter.
+ Adjust all calls.
+ (Target_i386::tls_desc_gd_to_ie): Likewise.
+ (Target_i386::relocate_tls): Don't insist that we have a TLS segment
+ for TLSDESC GD-to-IE optimizations.
+ * x86_64.cc (Target_x86_64::tls_gd_to_ie): Remove tls_segment parameter.
+ Adjust all calls.
+ (Target_x86_64::tls_desc_gd_to_ie): Likewise.
+ (Target_x86_64::relocate_tls): Don't insist that we have a TLS segment
+ for TLSDESC GD-to-IE optimizations.
+---
+ gold/aarch64.cc | 6 ------
+ gold/i386.cc | 14 ++------------
+ gold/x86_64.cc | 14 ++------------
+ 4 files changed, 20 insertions(+), 30 deletions(-)
+
+diff --git a/gold/aarch64.cc b/gold/aarch64.cc
+index 20f2f4f..5ad061b 100644
+--- a/gold/aarch64.cc
++++ b/gold/aarch64.cc
+@@ -7422,12 +7422,6 @@ Target_aarch64<size, big_endian>::Relocate::relocate_tls(
+ }
+ if (tlsopt == tls::TLSOPT_TO_IE)
+ {
+- if (tls_segment == NULL)
+- {
+- gold_assert(parameters->errors()->error_count() > 0
+- || issue_undefined_symbol_error(gsym));
+- return aarch64_reloc_funcs::STATUS_BAD_RELOC;
+- }
+ return tls_desc_gd_to_ie(relinfo, target, rela, r_type,
+ view, psymval, got_entry_address,
+ address);
+diff --git a/gold/i386.cc b/gold/i386.cc
+index 82886d4..a7168a8 100644
+--- a/gold/i386.cc
++++ b/gold/i386.cc
+@@ -668,7 +668,6 @@ class Target_i386 : public Sized_target<32, false>
+ // Do a TLS General-Dynamic to Initial-Exec transition.
+ inline void
+ tls_gd_to_ie(const Relocate_info<32, false>*, size_t relnum,
+- Output_segment* tls_segment,
+ const elfcpp::Rel<32, false>&, unsigned int r_type,
+ elfcpp::Elf_types<32>::Elf_Addr value,
+ unsigned char* view,
+@@ -687,7 +686,6 @@ class Target_i386 : public Sized_target<32, false>
+ // transition.
+ inline void
+ tls_desc_gd_to_ie(const Relocate_info<32, false>*, size_t relnum,
+- Output_segment* tls_segment,
+ const elfcpp::Rel<32, false>&, unsigned int r_type,
+ elfcpp::Elf_types<32>::Elf_Addr value,
+ unsigned char* view,
+@@ -3054,7 +3052,7 @@ Target_i386::Relocate::relocate_tls(const Relocate_info<32, false>* relinfo,
+ }
+ if (optimized_type == tls::TLSOPT_TO_IE)
+ {
+- this->tls_gd_to_ie(relinfo, relnum, tls_segment, rel, r_type,
++ this->tls_gd_to_ie(relinfo, relnum, rel, r_type,
+ got_offset, view, view_size);
+ break;
+ }
+@@ -3116,13 +3114,7 @@ Target_i386::Relocate::relocate_tls(const Relocate_info<32, false>* relinfo,
+ }
+ if (optimized_type == tls::TLSOPT_TO_IE)
+ {
+- if (tls_segment == NULL)
+- {
+- gold_assert(parameters->errors()->error_count() > 0
+- || issue_undefined_symbol_error(gsym));
+- return;
+- }
+- this->tls_desc_gd_to_ie(relinfo, relnum, tls_segment, rel, r_type,
++ this->tls_desc_gd_to_ie(relinfo, relnum, rel, r_type,
+ got_offset, view, view_size);
+ break;
+ }
+@@ -3354,7 +3346,6 @@ Target_i386::Relocate::tls_gd_to_le(const Relocate_info<32, false>* relinfo,
+ inline void
+ Target_i386::Relocate::tls_gd_to_ie(const Relocate_info<32, false>* relinfo,
+ size_t relnum,
+- Output_segment*,
+ const elfcpp::Rel<32, false>& rel,
+ unsigned int,
+ elfcpp::Elf_types<32>::Elf_Addr value,
+@@ -3449,7 +3440,6 @@ inline void
+ Target_i386::Relocate::tls_desc_gd_to_ie(
+ const Relocate_info<32, false>* relinfo,
+ size_t relnum,
+- Output_segment*,
+ const elfcpp::Rel<32, false>& rel,
+ unsigned int r_type,
+ elfcpp::Elf_types<32>::Elf_Addr value,
+diff --git a/gold/x86_64.cc b/gold/x86_64.cc
+index 3cfc064..4ad5afc 100644
+--- a/gold/x86_64.cc
++++ b/gold/x86_64.cc
+@@ -816,7 +816,6 @@ class Target_x86_64 : public Sized_target<size, false>
+ // Do a TLS General-Dynamic to Initial-Exec transition.
+ inline void
+ tls_gd_to_ie(const Relocate_info<size, false>*, size_t relnum,
+- Output_segment* tls_segment,
+ const elfcpp::Rela<size, false>&, unsigned int r_type,
+ typename elfcpp::Elf_types<size>::Elf_Addr value,
+ unsigned char* view,
+@@ -835,7 +834,6 @@ class Target_x86_64 : public Sized_target<size, false>
+ // Do a TLSDESC-style General-Dynamic to Initial-Exec transition.
+ inline void
+ tls_desc_gd_to_ie(const Relocate_info<size, false>*, size_t relnum,
+- Output_segment* tls_segment,
+ const elfcpp::Rela<size, false>&, unsigned int r_type,
+ typename elfcpp::Elf_types<size>::Elf_Addr value,
+ unsigned char* view,
+@@ -3733,7 +3731,7 @@ Target_x86_64<size>::Relocate::relocate_tls(
+ if (optimized_type == tls::TLSOPT_TO_IE)
+ {
+ value = target->got_plt_section()->address() + got_offset;
+- this->tls_gd_to_ie(relinfo, relnum, tls_segment, rela, r_type,
++ this->tls_gd_to_ie(relinfo, relnum, rela, r_type,
+ value, view, address, view_size);
+ break;
+ }
+@@ -3800,14 +3798,8 @@ Target_x86_64<size>::Relocate::relocate_tls(
+ }
+ if (optimized_type == tls::TLSOPT_TO_IE)
+ {
+- if (tls_segment == NULL)
+- {
+- gold_assert(parameters->errors()->error_count() > 0
+- || issue_undefined_symbol_error(gsym));
+- return;
+- }
+ value = target->got_plt_section()->address() + got_offset;
+- this->tls_desc_gd_to_ie(relinfo, relnum, tls_segment,
++ this->tls_desc_gd_to_ie(relinfo, relnum,
+ rela, r_type, value, view, address,
+ view_size);
+ break;
+@@ -3973,7 +3965,6 @@ inline void
+ Target_x86_64<size>::Relocate::tls_gd_to_ie(
+ const Relocate_info<size, false>* relinfo,
+ size_t relnum,
+- Output_segment*,
+ const elfcpp::Rela<size, false>& rela,
+ unsigned int,
+ typename elfcpp::Elf_types<size>::Elf_Addr value,
+@@ -4085,7 +4076,6 @@ inline void
+ Target_x86_64<size>::Relocate::tls_desc_gd_to_ie(
+ const Relocate_info<size, false>* relinfo,
+ size_t relnum,
+- Output_segment*,
+ const elfcpp::Rela<size, false>& rela,
+ unsigned int r_type,
+ typename elfcpp::Elf_types<size>::Elf_Addr value,
+--
+1.7.1
+
--
2.8.0
^ permalink raw reply related [flat|nested] 8+ messages in thread