Ignore and remove LD_HWCAP_MASK for AT_SECURE programs (bug #21209)

The LD_HWCAP_MASK environment variable may alter the selection of
function variants for some architectures.  For AT_SECURE process it
means that if an outdated routine has a bug that would otherwise not
affect newer platforms by default, LD_HWCAP_MASK will allow that bug
to be exploited.

To be on the safe side, ignore and disable LD_HWCAP_MASK for setuid
binaries.

	[BZ #21209]
	* elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for
	AT_SECURE processes.
	* sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK.

(cherry picked from commit 1c1243b6fc33c029488add276e56570a07803bfd)

diff --git a/ChangeLog b/ChangeLog
index 7b8c817b6815a9bc2d7ff1e2ba0c4508955b8dcc..f47f9eab04fdfdd2dc99b268a7123a9660998b7b 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2017-03-07  Siddhesh Poyarekar  <siddhesh@sourceware.org>
+
+       [BZ #21209]
+       * elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for
+       AT_SECURE processes.
+       * sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK.
+
 2017-06-19  Florian Weimer  <fweimer@redhat.com>
 
        * elf/rtld.c (audit_list_string): New variable.

diff --git a/NEWS b/NEWS
index d42af919728485080335f8a5d5a788d5d7994d8c..c4c082b41541c9dd70b1a4b0dd64b13fefeb1e44 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -23,6 +23,7 @@ Security related changes:
 
 The following bugs are resolved with this release:
 
+  [21209] Ignore and remove LD_HWCAP_MASK for AT_SECURE programs
   [21289] Fix symbol redirect for fts_set
   [21386] Assertion in fork for distinct parent PID is incorrect
   [21624] Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366)

diff --git a/elf/rtld.c b/elf/rtld.c
index 302bb6362095868e8c1188cf7ba41aef50978b93..8f56d6edd3890cfa31429a140b8aea339fcd63ca 100644 (file)
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -2553,7 +2553,8 @@ process_envvars (enum mode *modep)
 
        case 10:
          /* Mask for the important hardware capabilities.  */
-         if (memcmp (envline, "HWCAP_MASK", 10) == 0)
+         if (!__libc_enable_secure
+             && memcmp (envline, "HWCAP_MASK", 10) == 0)
            GLRO(dl_hwcap_mask) = __strtoul_internal (&envline[11], NULL,
                                                      0, 0);
          break;

diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h
index 3e56538b51c4acefff9aa9fb805ae22c641646f1..ac57bd5db007f2d133e8dd5210e47133de53353a 100644 (file)
--- a/sysdeps/generic/unsecvars.h
+++ b/sysdeps/generic/unsecvars.h
@@ -10,6 +10,7 @@
   "LD_DEBUG\0"                                                               \
   "LD_DEBUG_OUTPUT\0"                                                        \
   "LD_DYNAMIC_WEAK\0"                                                        \
+  "LD_HWCAP_MASK\0"                                                          \
   "LD_LIBRARY_PATH\0"                                                        \
   "LD_ORIGIN_PATH\0"                                                         \
   "LD_PRELOAD\0"                                                             \