From 901d3d5aaab248c9b2a85ac589e4bad8b8e636b2 Mon Sep 17 00:00:00 2001
From: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date: Tue, 7 Mar 2017 20:52:04 +0530
Subject: [PATCH] Ignore and remove LD_HWCAP_MASK for AT_SECURE programs (bug
 #21209)

The LD_HWCAP_MASK environment variable may alter the selection of
function variants for some architectures.  For AT_SECURE process it
means that if an outdated routine has a bug that would otherwise not
affect newer platforms by default, LD_HWCAP_MASK will allow that bug
to be exploited.

To be on the safe side, ignore and disable LD_HWCAP_MASK for setuid
binaries.

	[BZ #21209]
	* elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for
	AT_SECURE processes.
	* sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK.

(cherry picked from commit 1c1243b6fc33c029488add276e56570a07803bfd)
---
 ChangeLog                   | 7 +++++++
 NEWS                        | 1 +
 elf/rtld.c                  | 3 ++-
 sysdeps/generic/unsecvars.h | 1 +
 4 files changed, 11 insertions(+), 1 deletion(-)

#diff --git a/ChangeLog b/ChangeLog
#index 1aa5867c4e..41f6ad1843 100644
#--- a/ChangeLog
#+++ b/ChangeLog
#@@ -1,3 +1,10 @@
#+2017-03-07  Siddhesh Poyarekar  <siddhesh@sourceware.org>
#+
#+	[BZ #21209]
#+	* elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for
#+	AT_SECURE processes.
#+	* sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK.
#+
# 2017-06-19  Florian Weimer  <fweimer@redhat.com>
# 
# 	* elf/rtld.c (audit_list_string): New variable.
#diff --git a/NEWS b/NEWS
#index 76a7f6a193..017d3c14f6 100644
#--- a/NEWS
#+++ b/NEWS
#@@ -42,6 +42,7 @@ The following bugs are resolved with this release:
#     (CVE-2016-3075)
#   [20177] $dp is not initialized correctly in sysdeps/hppa/start.S
##   [20357] Incorrect cos result for 1.5174239687223976
#+  [21209] Ignore and remove LD_HWCAP_MASK for AT_SECURE programs
#   [21289] Fix symbol redirect for fts_set
#   [21624] Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366)
# 
diff --git a/elf/rtld.c b/elf/rtld.c
index 302bb63620..8f56d6edd3 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -2553,7 +2553,8 @@ process_envvars (enum mode *modep)
 
 	case 10:
 	  /* Mask for the important hardware capabilities.  */
-	  if (memcmp (envline, "HWCAP_MASK", 10) == 0)
+	  if (!__libc_enable_secure
+	      && memcmp (envline, "HWCAP_MASK", 10) == 0)
 	    GLRO(dl_hwcap_mask) = __strtoul_internal (&envline[11], NULL,
 						      0, 0);
 	  break;
diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h
index 3e56538b51..ac57bd5db0 100644
--- a/sysdeps/generic/unsecvars.h
+++ b/sysdeps/generic/unsecvars.h
@@ -10,6 +10,7 @@
   "LD_DEBUG\0"								      \
   "LD_DEBUG_OUTPUT\0"							      \
   "LD_DYNAMIC_WEAK\0"							      \
+  "LD_HWCAP_MASK\0"							      \
   "LD_LIBRARY_PATH\0"							      \
   "LD_ORIGIN_PATH\0"							      \
   "LD_PRELOAD\0"							      \
-- 
2.13.1