From 901d3d5aaab248c9b2a85ac589e4bad8b8e636b2 Mon Sep 17 00:00:00 2001 From: Siddhesh Poyarekar <siddhesh@sourceware.org> Date: Tue, 7 Mar 2017 20:52:04 +0530 Subject: [PATCH] Ignore and remove LD_HWCAP_MASK for AT_SECURE programs (bug #21209) The LD_HWCAP_MASK environment variable may alter the selection of function variants for some architectures. For AT_SECURE process it means that if an outdated routine has a bug that would otherwise not affect newer platforms by default, LD_HWCAP_MASK will allow that bug to be exploited. To be on the safe side, ignore and disable LD_HWCAP_MASK for setuid binaries. [BZ #21209] * elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for AT_SECURE processes. * sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK. (cherry picked from commit 1c1243b6fc33c029488add276e56570a07803bfd) --- ChangeLog | 7 +++++++ NEWS | 1 + elf/rtld.c | 3 ++- sysdeps/generic/unsecvars.h | 1 + 4 files changed, 11 insertions(+), 1 deletion(-) #diff --git a/ChangeLog b/ChangeLog #index 1aa5867c4e..41f6ad1843 100644 #--- a/ChangeLog #+++ b/ChangeLog #@@ -1,3 +1,10 @@ #+2017-03-07 Siddhesh Poyarekar <siddhesh@sourceware.org> #+ #+ [BZ #21209] #+ * elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for #+ AT_SECURE processes. #+ * sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK. #+ # 2017-06-19 Florian Weimer <fweimer@redhat.com> # # * elf/rtld.c (audit_list_string): New variable. #diff --git a/NEWS b/NEWS #index 76a7f6a193..017d3c14f6 100644 #--- a/NEWS #+++ b/NEWS #@@ -42,6 +42,7 @@ The following bugs are resolved with this release: # (CVE-2016-3075) # [20177] $dp is not initialized correctly in sysdeps/hppa/start.S ## [20357] Incorrect cos result for 1.5174239687223976 #+ [21209] Ignore and remove LD_HWCAP_MASK for AT_SECURE programs # [21289] Fix symbol redirect for fts_set # [21624] Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366) # diff --git a/elf/rtld.c b/elf/rtld.c index 302bb63620..8f56d6edd3 100644 --- a/elf/rtld.c +++ b/elf/rtld.c @@ -2553,7 +2553,8 @@ process_envvars (enum mode *modep) case 10: /* Mask for the important hardware capabilities. */ - if (memcmp (envline, "HWCAP_MASK", 10) == 0) + if (!__libc_enable_secure + && memcmp (envline, "HWCAP_MASK", 10) == 0) GLRO(dl_hwcap_mask) = __strtoul_internal (&envline[11], NULL, 0, 0); break; diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h index 3e56538b51..ac57bd5db0 100644 --- a/sysdeps/generic/unsecvars.h +++ b/sysdeps/generic/unsecvars.h @@ -10,6 +10,7 @@ "LD_DEBUG\0" \ "LD_DEBUG_OUTPUT\0" \ "LD_DYNAMIC_WEAK\0" \ + "LD_HWCAP_MASK\0" \ "LD_LIBRARY_PATH\0" \ "LD_ORIGIN_PATH\0" \ "LD_PRELOAD\0" \ -- 2.13.1