Bug 1774681 (CVE-2019-19126)

Summary: CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aoliva, arjun.is, ashankar, bdettelb, codonell, dj, fweimer, glibc-bugzilla, jschorr, law, mfabian, mnewsome, pfrankli, rth, siddhesh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: glibc 2.31 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to force system to utilize only half of the memory (making the system think the software is 32-bit only), thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest threat is confidentiality although the complexity of attack is high. The affected application must already have other vulnerabilities for this flaw to be usable.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-04-28 16:34:38 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1774021, 1774682, 1775599, 1775600    
Bug Blocks: 1774683    

Description Guilherme de Almeida Suckevicz 2019-11-20 17:09:15 UTC
On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=25204

Comment 1 Riccardo Schirone 2019-11-21 17:12:27 UTC
LD_PREFER_MAP_32BIT_EXEC is an environment variable that can be set to let the dynamic linker first try to map executable pages using the mmap flag MAP_32BIT, which will map to the low 2 GB of the address space. According to the documentation, LD_PREFER_MAP_32BIT_EXEC should be disabled for setuid binaries, however the code using it (https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h;h=0e95221908b07eb29c33deda31e6e830ae151fbe;hb=2a764c6ee848dfe92cb2921ed3b14085f15d9e79#l32) is run before the code that removes security-sensitive environment variables.

Comment 7 errata-xmlrpc 2020-04-28 15:57:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1828 https://access.redhat.com/errata/RHSA-2020:1828

Comment 8 Product Security DevOps Team 2020-04-28 16:34:38 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19126

Comment 9 errata-xmlrpc 2020-09-29 19:20:25 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3861 https://access.redhat.com/errata/RHSA-2020:3861