Bug 1246713
| Summary: | CVE-2015-5229 glibc: calloc() returns non-zero'ed memory | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Josef Bacik <josef> | ||||
| Component: | glibc | Assignee: | Siddhesh Poyarekar <spoyarek> | ||||
| Status: | CLOSED ERRATA | QA Contact: | qe-baseos-tools-bugs | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 6.7 | CC: | ashankar, codonell, cww, fweimer, mikolaj, mnewsome, pfrankli, salmy, spoyarek | ||||
| Target Milestone: | rc | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 1256288 1293976 1294080 (view as bug list) | Environment: | |||||
| Last Closed: | 2015-08-24 09:58:22 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1245731 | ||||||
| Bug Blocks: | 1256285, 1293976, 1294080 | ||||||
| Attachments: |
|
||||||
(In reply to Josef Bacik from comment #0) > Created attachment 1055966 [details] > patch to fix the problem. > > Description of problem: > At Facebook we had an app that started hanging and crashing weirdly when > going from glibc-2.12-1.149.el6.x86_64 to glibc-2.12-1.163.el6.x86_64. Please note that there is already a RHEL 6.7.z errata that fixes this, and it was released two days ago: https://rhn.redhat.com/errata/RHBA-2015-1465.html Please update to glibc-2.12-1.166.el6_7.1. One question, when you write "glibc-2.12-1.163.el6.x86_64" do you actually mean "glibc-2.12-1.166.el6.x86_64?" (note .166 not .163)? Lastly, the robust malloc support has been backed out for the release, but we plan to put it back in as soon as we are certain we've corrected the remaining issues. Would you be interested in testing an unsupported non-production build with the new feature? We're on Centos, not RHEL, we just happened to end up with the .163 release (I'm not sure how) before 6.7 was released. Give me whatever package you want me to test, we don't care about unsupported, obviously we are capable of supporting ourselves ;). I do need to have an src.rpm tho so I can build and test it on our systems and verify the issue I was seeing is actually fixed. (In reply to Josef Bacik from comment #5) > We're on Centos, not RHEL, we just happened to end up with the .163 release > (I'm not sure how) before 6.7 was released. Give me whatever package you > want me to test, we don't care about unsupported, obviously we are capable > of supporting ourselves ;). I do need to have an src.rpm tho so I can build > and test it on our systems and verify the issue I was seeing is actually > fixed. Sounds good. We'll get you something when we're ready. Thanks for agreeing to test :-) Removing the "already fixed in 6.7.z" from the title because it confused me the couple of times I read it. This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHBA-2015:1465 https://rhn.redhat.com/errata/RHBA-2015-1465.html The SRPM is available here: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/glibc-2.12-1.166.el6_7.1.src.rpm |
Created attachment 1055966 [details] patch to fix the problem. Description of problem: At Facebook we had an app that started hanging and crashing weirdly when going from glibc-2.12-1.149.el6.x86_64 to glibc-2.12-1.163.el6.x86_64. Turns out this patch glibc-rh1066724.patch Introduced the problem. You added the following bit to _int_malloc() + /* There are no usable arenas. Fall back to sysmalloc to get a chunk from + mmap. */ + if (__glibc_unlikely (av == NULL)) + { + void *p = sYSMALLOc (nb, av); + if (p != NULL) + alloc_perturb (p, bytes); + return p; + } + But this isn't ok, alloc_perturb unconditionally memset's the front byte to 0xf, unlike upstream where it checks to see if perturb_byte is set. This needs to be changed to if (p != NULL && && __builtin_expect(perturb_byte, 0)) alloc_perturb (p, bytes); return p; The patch I've attached fixes the problem for me. This problem is exacerbated by the fact that any sort of lock contention on the arena's results in us falling back on mmap()'ing a new chunk. This is because we check to see if the uncontended arena we check is corrupt, and if it is we loop through, and if we loop to the beginning we know we didn't find anything. Except if our initial arena isn't actually corrupt we'll still return NULL, so we fall back on this mmap() thing more often, which really makes things unstable. Please get this fixed as soon as possible, I'd even go so far as to call it a possible security issue.