From a3d7865b098a3a67c44f7812208d9ce4718873ba Mon Sep 17 00:00:00 2001 From: Siddhesh Poyarekar Date: Tue, 21 Jan 2025 16:11:06 -0500 Subject: [PATCH] Fix underallocation of abort_msg_s struct (CVE-2025-0395) Include the space needed to store the length of the message itself, in addition to the message string. This resolves BZ #32582. Signed-off-by: Siddhesh Poyarekar Reviewed: Adhemerval Zanella (cherry picked from commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578) --- NEWS | 6 ++++++ assert/assert.c | 4 +++- sysdeps/posix/libc_fatal.c | 4 +++- 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index 18d3fa912df..0d6c4b0f6e3 100644 --- a/NEWS +++ b/NEWS @@ -41,6 +41,11 @@ Security related changes: buffer overflow, which could be exploited to achieve escalated privileges. This flaw was introduced in glibc 2.34. + CVE-2025-0395: When the assert() function fails, it does not allocate + enough space for the assertion failure message string and size + information, which may lead to a buffer overflow if the message string + size aligns to page size. + The following bugs are resolved with this release: [20975] Deferred cancellation triggers in __check_pf and looses lock leading to deadlock @@ -73,6 +78,7 @@ The following bugs are resolved with this release: [32137] libio: Attempt wide backup free only for non-legacy code [32231] elf: Change ldconfig auxcache magic number [32470] x86: Avoid integer truncation with large cache sizes + [32582] Fix underallocation of abort_msg_s struct (CVE-2025-0395) Version 2.37 diff --git a/assert/assert.c b/assert/assert.c index b7c7a4a1ba3..65a9fedf0d8 100644 --- a/assert/assert.c +++ b/assert/assert.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include @@ -64,7 +65,8 @@ __assert_fail_base (const char *fmt, const char *assertion, const char *file, (void) __fxprintf (NULL, "%s", str); (void) fflush (stderr); - total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1); + total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1, + GLRO(dl_pagesize)); struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0); if (__glibc_likely (buf != MAP_FAILED)) diff --git a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c index 70edcc10c15..5b9e4b79186 100644 --- a/sysdeps/posix/libc_fatal.c +++ b/sysdeps/posix/libc_fatal.c @@ -20,6 +20,7 @@ #include #include #include +#include #include #include #include @@ -123,7 +124,8 @@ __libc_message (const char *fmt, ...) WRITEV_FOR_FATAL (fd, iov, nlist, total); - total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1); + total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1, + GLRO(dl_pagesize)); struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0); -- 2.47.2