Bug 1774681 (CVE-2019-19126)

Summary:	CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aoliva, arjun.is, ashankar, bdettelb, codonell, dj, fweimer, glibc-bugzilla, jschorr, law, mfabian, mnewsome, pfrankli, rth, siddhesh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	glibc 2.31	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to force system to utilize only half of the memory (making the system think the software is 32-bit only), thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest threat is confidentiality although the complexity of attack is high. The affected application must already have other vulnerabilities for this flaw to be usable.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-04-28 16:34:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1774021, 1774682, 1775599, 1775600
Bug Blocks:	1774683

Description Guilherme de Almeida Suckevicz 2019-11-20 17:09:15 UTC

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=25204

Comment 1 Riccardo Schirone 2019-11-21 17:12:27 UTC

LD_PREFER_MAP_32BIT_EXEC is an environment variable that can be set to let the dynamic linker first try to map executable pages using the mmap flag MAP_32BIT, which will map to the low 2 GB of the address space. According to the documentation, LD_PREFER_MAP_32BIT_EXEC should be disabled for setuid binaries, however the code using it (https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h;h=0e95221908b07eb29c33deda31e6e830ae151fbe;hb=2a764c6ee848dfe92cb2921ed3b14085f15d9e79#l32) is run before the code that removes security-sensitive environment variables.

Comment 2 Riccardo Schirone 2019-11-21 17:12:50 UTC

Upstream patch:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d5dfad4326fc683c813df1e37bbf5cf920591c8e

Comment 3 Riccardo Schirone 2019-11-21 17:13:37 UTC

Issue introduced in:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=object;h=b9eb92ab05204df772eb4929eccd018637c9f3e9

Comment 7 errata-xmlrpc 2020-04-28 15:57:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1828 https://access.redhat.com/errata/RHSA-2020:1828

Comment 8 Product Security DevOps Team 2020-04-28 16:34:38 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19126

Comment 9 errata-xmlrpc 2020-09-29 19:20:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3861 https://access.redhat.com/errata/RHSA-2020:3861