rtld: Check __libc_enable_secure before honoring LD_PREFER_MAP_32BIT_EXEC (CVE-2019...

The problem was introduced in glibc 2.23, in commit
b9eb92ab05204df772eb4929eccd018637c9f3e9
("Add Prefer_MAP_32BIT_EXEC to map executable pages with MAP_32BIT").

(cherry picked from commit d5dfad4326fc683c813df1e37bbf5cf920591c8e)

diff --git a/NEWS b/NEWS
index 9bbcfd137ac0816a4251e7b21b6efe76bfc53abe..82b0baa5faaae7b1f92633810cf3452a5b214809 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -28,6 +28,12 @@ Security related changes:
   (denial of service) in some Go applications compiled with gccgo.  Reported
   by Andreas Schwab.  (CVE-2016-6323)
 
+  CVE-2019-19126: ld.so failed to ignore the LD_PREFER_MAP_32BIT_EXEC
+  environment variable during program execution after a security
+  transition, allowing local attackers to restrict the possible mapping
+  addresses for loaded libraries and thus bypass ASLR for a setuid
+  program.  Reported by Marcin Kościelnicki.
+
 The following bugs are resolved with this release:
 
   [19679] gcc-4.9.3 C++ exception handling broken due to unaligned stack
@@ -49,6 +55,7 @@ The following bugs are resolved with this release:
   [21666] Avoid .symver on common symbols
   [22641] x86: Fix mis-merge of XSAVE ld.so trampoline selection
   [22715] x86-64: Properly align La_x86_64_retval to VEC_SIZE
+  [25204] Ignore LD_PREFER_MAP_32BIT_EXEC for SUID programs
 
 \f
 Version 2.23

diff --git a/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h b/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
index a759934fdd91287715cb9c12e91914065ea44735..b13bba65d260708f5c3c4f9fd64b9a131273427a 100644 (file)
--- a/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
+++ b/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
@@ -31,7 +31,8 @@
    environment variable, LD_PREFER_MAP_32BIT_EXEC.  */
 #define EXTRA_LD_ENVVARS \
   case 21:                                                           \
-    if (memcmp (envline, "PREFER_MAP_32BIT_EXEC", 21) == 0)          \
+    if (!__libc_enable_secure                                        \
+       && memcmp (envline, "PREFER_MAP_32BIT_EXEC", 21) == 0)        \
       GLRO(dl_x86_cpu_features).feature[index_Prefer_MAP_32BIT_EXEC]  \
        |= bit_Prefer_MAP_32BIT_EXEC;                                 \
     break;