From: Marcin Kościelnicki <mwk@0x04.net>
Date: Wed, 20 Nov 2019 23:20:15 +0000 (+0100)
Subject: rtld: Check __libc_enable_secure before honoring LD_PREFER_MAP_32BIT_EXEC (CVE-2019... 
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b039fd85db0717aca309b61925d00a5a6547a649;p=thirdparty%2Fglibc.git

rtld: Check __libc_enable_secure before honoring LD_PREFER_MAP_32BIT_EXEC (CVE-2019-19126) [BZ #25204]

The problem was introduced in glibc 2.23, in commit
b9eb92ab05204df772eb4929eccd018637c9f3e9
("Add Prefer_MAP_32BIT_EXEC to map executable pages with MAP_32BIT").

(cherry picked from commit d5dfad4326fc683c813df1e37bbf5cf920591c8e)
---

diff --git a/NEWS b/NEWS
index 9bbcfd137ac..82b0baa5faa 100644
--- a/NEWS
+++ b/NEWS
@@ -28,6 +28,12 @@ Security related changes:
   (denial of service) in some Go applications compiled with gccgo.  Reported
   by Andreas Schwab.  (CVE-2016-6323)
 
+  CVE-2019-19126: ld.so failed to ignore the LD_PREFER_MAP_32BIT_EXEC
+  environment variable during program execution after a security
+  transition, allowing local attackers to restrict the possible mapping
+  addresses for loaded libraries and thus bypass ASLR for a setuid
+  program.  Reported by Marcin Kościelnicki.
+
 The following bugs are resolved with this release:
 
   [19679] gcc-4.9.3 C++ exception handling broken due to unaligned stack
@@ -49,6 +55,7 @@ The following bugs are resolved with this release:
   [21666] Avoid .symver on common symbols
   [22641] x86: Fix mis-merge of XSAVE ld.so trampoline selection
   [22715] x86-64: Properly align La_x86_64_retval to VEC_SIZE
+  [25204] Ignore LD_PREFER_MAP_32BIT_EXEC for SUID programs
 
 
 Version 2.23
diff --git a/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h b/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
index a759934fdd9..b13bba65d26 100644
--- a/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
+++ b/sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h
@@ -31,7 +31,8 @@
    environment variable, LD_PREFER_MAP_32BIT_EXEC.  */
 #define EXTRA_LD_ENVVARS \
   case 21:							      \
-    if (memcmp (envline, "PREFER_MAP_32BIT_EXEC", 21) == 0)	      \
+    if (!__libc_enable_secure					      \
+	&& memcmp (envline, "PREFER_MAP_32BIT_EXEC", 21) == 0)	      \
       GLRO(dl_x86_cpu_features).feature[index_Prefer_MAP_32BIT_EXEC]  \
 	|= bit_Prefer_MAP_32BIT_EXEC;				      \
     break;