[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAN_LGv0x+LeHrROT-cTdDcqYMj5W6Cw0cZZ05ov3kezguKVvBw@mail.gmail.com>
Date: Mon, 5 Feb 2024 17:02:52 +0800
From: "Alexander E. Patrakov" <patrakov@...il.com>
To: oss-security@...ts.openwall.com
Cc: Qualys Security Advisory <qsa@...lys.com>, Adhemerval Zanella <adhemerval.zanella@...aro.org>
Subject: Re: Out-of-bounds read & write in the glibc's qsort()
On Mon, Feb 5, 2024 at 4:45 PM Alexander E. Patrakov <patrakov@...il.com> wrote:
>
> On Mon, Feb 5, 2024 at 4:40 PM Alexander E. Patrakov <patrakov@...il.com> wrote:
> >
> > On Mon, Feb 5, 2024 at 12:36 AM Solar Designer <solar@...nwall.com> wrote:
> >
> > > It's so invasive I cannot easily tell whether qsort() remained robust
> > > after it or not. There's no longer a "tmp_ptr != base_ptr &&" check.
> > > So, lacking known-working tests in glibc tree, we don't know about glibc
> > > 2.39's status with respect to this issue.
> > >
> > > I don't have a glibc 2.39 build handy. Perhaps someone on a distro that
> > > has already updated can run the attached test program and let us know?
> >
> > Here you go: no output on Arch Linux.
> >
> > [aep@...-haswell tmp]$ gcc ./glibc-qualys-rocky-qsort-test.c
> > [aep@...-haswell tmp]$ ./a.out
> > [aep@...-haswell tmp]$ /lib64/libc.so.6
> > GNU C Library (GNU libc) stable release version 2.39.
> > Copyright (C) 2024 Free Software Foundation, Inc.
> > This is free software; see the source for copying conditions.
> > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
> > PARTICULAR PURPOSE.
> > Compiled by GNU CC version 13.2.1 20230801.
> > libc ABIs: UNIQUE IFUNC ABSOLUTE
> > Minimum supported kernel: 4.4.0
> > For bug reporting instructions, please see:
> > <https://gitlab.archlinux.org/archlinux/packaging/packages/glibc/-/issues>.
> >
> > --
> > Alexander E. Patrakov
>
> Sorry, I should have followed the instructions.
>
> [aep@...-haswell tmp]$ while true; do n=$((RANDOM*64+RANDOM+1));
> prlimit --as=$((n*4/2*3)) ./a.out $n; done
>
> This results in a mix of these outputs:
>
> PASSED
> ./a.out: error while loading shared libraries: libc.so.6: failed to
> map segment from shared object
> Segmentation fault
>
> --
> Alexander E. Patrakov
Upon investigation, I have to add: the segmentation faults come from
code that runs before main(), so they do not indicate a problem in
qsort().
--
Alexander E. Patrakov
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
