Don't write beyond destination in __mempcpy_avx512_no_vzeroupper (bug 23196)

When compiled as mempcpy, the return value is the end of the destination
buffer, thus it cannot be used to refer to the start of it.

(cherry picked from commit 9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e)

diff --git a/ChangeLog b/ChangeLog
index f92be1355d5466ac18c0a4a9ef84bc74c6c5814f..e956dd3d6678a57a79f76f75acc7830329c1e28c 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2018-05-23  Andreas Schwab  <schwab@suse.de>
+
+       [BZ #23196]
+       CVE-2018-11237
+       * sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
+       (L(preloop_large)): Save initial destination pointer in %r11 and
+       use it instead of %rax after the loop.
+       * string/test-mempcpy.c (MIN_PAGE_SIZE): Define.
+
 2018-05-09  Paul Pluzhnikov  <ppluzhnikov@google.com>
 
        [BZ #22786]

diff --git a/NEWS b/NEWS
index d5daa3adc5610da40c0f86f226782a983b5c15f1..c3c6aff8fc6275f1dd73522e2117aeafb549eff3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -71,6 +71,10 @@ Security related changes:
   the value of SIZE_MAX, would return a pointer to a buffer which is too
   small, instead of NULL.
 
+  CVE-2018-11237: The mempcpy implementation for the Intel Xeon Phi
+  architecture could write beyond the target buffer, resulting in a buffer
+  overflow.  Reported by Andreas Schwab.
+
 The following bugs are resolved with this release:
 
   [16750] ldd: Never run file directly.
@@ -128,6 +132,7 @@ The following bugs are resolved with this release:
   [23024] getlogin_r: return early when linux sentinel value is set
   [23037] resolv: Fully initialize struct mmsghdr in send_dg
   [23137] s390: Fix blocking pthread_join
+  [23196] __mempcpy_avx512_no_vzeroupper mishandles large copies
 \f
 Version 2.26
 

diff --git a/string/test-mempcpy.c b/string/test-mempcpy.c
index 364a811c62f24f55524fb439cb190260411d2243..ec11c9f6e6c94b8b1ca41bb2b2fc530dacd9beb0 100644 (file)
--- a/string/test-mempcpy.c
+++ b/string/test-mempcpy.c
@@ -18,6 +18,7 @@
    <http://www.gnu.org/licenses/>.  */
 
 #define MEMCPY_RESULT(dst, len) (dst) + (len)
+#define MIN_PAGE_SIZE 131072
 #define TEST_MAIN
 #define TEST_NAME "mempcpy"
 #include "test-string.h"

diff --git a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
index f3ef10577cefdccee66e57eb1a72e4df1382d23e..ae84ddc667948aa9a0e653703a2112fd4e5e531a 100644 (file)
--- a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
+++ b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
@@ -340,6 +340,7 @@ L(preloop_large):
        vmovups (%rsi), %zmm4
        vmovups 0x40(%rsi), %zmm5
 
+       mov     %rdi, %r11
 /* Align destination for access with non-temporal stores in the loop.  */
        mov     %rdi, %r8
        and     $-0x80, %rdi
@@ -370,8 +371,8 @@ L(gobble_256bytes_nt_loop):
        cmp     $256, %rdx
        ja      L(gobble_256bytes_nt_loop)
        sfence
-       vmovups %zmm4, (%rax)
-       vmovups %zmm5, 0x40(%rax)
+       vmovups %zmm4, (%r11)
+       vmovups %zmm5, 0x40(%r11)
        jmp     L(check)
 
 L(preloop_large_bkw):