Bug 1452543 (CVE-2017-1000366)

Summary: CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations
Product: [Other] Security Response Reporter: Petr Matousek <pmatouse>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: arjun, ashankar, codonell, cperry, cye, dhoward, dj, dvlasenk, fche, fweimer, glibc-bugzilla, huzaifas, jeyu, jkastner, joe.lawrence, jpoimboe, kent, law, lkuprova, lwoodman, mcermak, mfabian, mmilgram, mnewsome, pasik, pfrankli, riel, security-response-team, siddhesh, skontar, slawomir, vdronov
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult.
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-06-27 20:44:02 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1452674, 1452709, 1452710, 1452711, 1452712, 1452713, 1452714, 1452715, 1452716, 1452717, 1452718, 1452720, 1452721, 1462820, 1462923    
Bug Blocks: 1449010    

Description Petr Matousek 2017-05-19 07:41:37 UTC
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the heap/stack gap, cause controlled memory corruption on process stack or heap, and thus increase their privileges on the system.

This is a tracking bug for the glibc part of the mitigation.

Comment 21 Petr Matousek 2017-06-14 08:50:34 UTC
Acknowledgments:

Name: Qualys Research Labs

Comment 37 Petr Matousek 2017-06-19 15:47:03 UTC
Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1462820]

Comment 39 errata-xmlrpc 2017-06-19 18:49:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1481 https://access.redhat.com/errata/RHSA-2017:1481

Comment 40 errata-xmlrpc 2017-06-19 19:37:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:1480 https://access.redhat.com/errata/RHSA-2017:1480

Comment 41 errata-xmlrpc 2017-06-19 20:17:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5 Extended Lifecycle Support
  Red Hat Enterprise Linux 5.9 Long Life
  Red Hat Enterprise Linux 6.2 Advanced Update Support
  Red Hat Enterprise Linux 6.4 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Telco Extended Update Support
  Red Hat Enterprise Linux 6.6 Advanced Update Support
  Red Hat Enterprise Linux 6.6 Telco Extended Update Support
  Red Hat Enterprise Linux 6.7 Extended Update Support
  Red Hat Enterprise Linux 7.2 Extended Update Support

Via RHSA-2017:1479 https://access.redhat.com/errata/RHSA-2017:1479

Comment 42 errata-xmlrpc 2017-06-21 15:11:56 UTC
This issue has been addressed in the following products:

  CDK 3.0

Via RHSA-2017:1567 https://access.redhat.com/errata/RHSA-2017:1567

Comment 43 Petr Matousek 2017-08-25 09:01:11 UTC
Statement:

This is a glibc-side mitigation. For a related kernel mitigation please see https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-1000364 .