glibc: Fix CVE-2021-33574 and follow-up issue

The mq_notify function has a potential use-after-free issue when using a
notification type of SIGEV_THREAD and a thread attribute with a non-default
affinity mask.

The fix for this introduced a NULL pointer dereference.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

diff --git a/lfs/glibc b/lfs/glibc
index aa7948aed67864b50d48efd3430b4840be883abb..5dbc386d7699b88621909d039ad467caf32751e0 100644 (file)
--- a/lfs/glibc
+++ b/lfs/glibc
@@ -109,6 +109,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
        @rm -rf $(DIR_APP) $(DIR_SRC)/glibc-build && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
        @mkdir $(DIR_SRC)/glibc-build
 
+       # Security Fixes
+       cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch
+       cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch
+
        cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-localedef-no-archive.patch
 
 ifneq "$(TOOLCHAIN)" "1"

diff --git a/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch b/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch
new file mode 100644 (file)
index 0000000..d2083e6
--- /dev/null
+++ b/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch
@@ -0,0 +1,40 @@
+From 27a78fd712c06748737dfa9638fab96ea362fca9 Mon Sep 17 00:00:00 2001
+From: Nikita Popov <npv1310@gmail.com>
+Date: Mon, 9 Aug 2021 20:17:34 +0530
+Subject: [PATCH] librt: fix NULL pointer dereference (bug 28213)
+
+Helper thread frees copied attribute on NOTIFY_REMOVED message
+received from the OS kernel.  Unfortunately, it fails to check whether
+copied attribute actually exists (data.attr != NULL).  This worked
+earlier because free() checks passed pointer before actually
+attempting to release corresponding memory.  But
+__pthread_attr_destroy assumes pointer is not NULL.
+
+So passing NULL pointer to __pthread_attr_destroy will result in
+segmentation fault.  This scenario is possible if
+notification->sigev_notify_attributes == NULL (which means default
+thread attributes should be used).
+
+Signed-off-by: Nikita Popov <npv1310@gmail.com>
+Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
+(cherry picked from commit b805aebd42364fe696e417808a700fdb9800c9e8)
+---
+ sysdeps/unix/sysv/linux/mq_notify.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c
+index 6f46d29d1d..1714e1cc5f 100644
+--- a/sysdeps/unix/sysv/linux/mq_notify.c
++++ b/sysdeps/unix/sysv/linux/mq_notify.c
+@@ -132,7 +132,7 @@ helper_thread (void *arg)
+              to wait until it is done with it.  */
+           (void) __pthread_barrier_wait (&notify_barrier);
+       }
+-      else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED)
++      else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED && data.attr != NULL)
+       {
+         /* The only state we keep is the copy of the thread attributes.  */
+         pthread_attr_destroy (data.attr);
+-- 
+2.20.1
+

diff --git a/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch b/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch
new file mode 100644 (file)
index 0000000..f846b37
--- /dev/null
+++ b/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch
@@ -0,0 +1,74 @@
+From 4b6be914bd3920500a67ef6ca1aa7d1c37e5e859 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@linux-m68k.org>
+Date: Thu, 27 May 2021 12:49:47 +0200
+Subject: [PATCH] Use __pthread_attr_copy in mq_notify (bug 27896)
+
+Make a deep copy of the pthread attribute object to remove a potential
+use-after-free issue.
+
+(cherry picked from commit 42d359350510506b87101cf77202fefcbfc790cb)
+---
+ NEWS                                |  6 ++++++
+ sysdeps/unix/sysv/linux/mq_notify.c | 15 ++++++++++-----
+ 2 files changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/NEWS b/NEWS
+index 0c33a80af9..b9e570b4a4 100644
+--- a/NEWS
++++ b/NEWS
+@@ -13,6 +13,12 @@ Major new features:
+   a dump of information related to IFUNC resolver operation and
+   glibc-hwcaps subdirectory selection.
+ 
++Security related changes:
++
++  CVE-2021-33574: The mq_notify function has a potential use-after-free
++  issue when using a notification type of SIGEV_THREAD and a thread
++  attribute with a non-default affinity mask.
++
+ The following bugs are resolved with this release:
+ 
+   [15271] dlfcn function failure after dlmopen terminates process
+diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c
+index cc575a0cdd..f7ddfe5a6c 100644
+--- a/sysdeps/unix/sysv/linux/mq_notify.c
++++ b/sysdeps/unix/sysv/linux/mq_notify.c
+@@ -133,8 +133,11 @@ helper_thread (void *arg)
+           (void) __pthread_barrier_wait (&notify_barrier);
+       }
+       else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED)
+-      /* The only state we keep is the copy of the thread attributes.  */
+-      free (data.attr);
++      {
++        /* The only state we keep is the copy of the thread attributes.  */
++        pthread_attr_destroy (data.attr);
++        free (data.attr);
++      }
+     }
+   return NULL;
+ }
+@@ -255,8 +258,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
+       if (data.attr == NULL)
+       return -1;
+ 
+-      memcpy (data.attr, notification->sigev_notify_attributes,
+-            sizeof (pthread_attr_t));
++      __pthread_attr_copy (data.attr, notification->sigev_notify_attributes);
+     }
+ 
+   /* Construct the new request.  */
+@@ -270,7 +272,10 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification)
+ 
+   /* If it failed, free the allocated memory.  */
+   if (__glibc_unlikely (retval != 0))
+-    free (data.attr);
++    {
++      pthread_attr_destroy (data.attr);
++      free (data.attr);
++    }
+ 
+   return retval;
+ }
+-- 
+2.20.1
+