Bug 643396 (CVE-2010-3192)

Summary: CVE-2010-3192 glibc: __fortify_fail may use corrupted memory when called from SSP callback
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bressers, fweimer, jakub, schwab, wnefal+redhatbugzilla
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-02-02 21:02:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2010-10-15 13:47:27 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-3192 to
the following vulnerability:

Certain run-time memory protection mechanisms in the GNU C Library
(aka glibc or libc6) print argv[0] and backtrace information, which
might allow context-dependent attackers to obtain sensitive
information from process memory by executing an incorrect program, as
demonstrated by a setuid program that contains a stack-based buffer
overflow error, related to the __fortify_fail function in
debug/fortify_fail.c, and the __stack_chk_fail (aka stack protection)
and __chk_fail (aka FORTIFY_SOURCE) implementations.

References:
[1] http://seclists.org/fulldisclosure/2010/Apr/399
[2] http://www.openwall.com/lists/oss-security/2010/08/25/8
[3] http://www.openwall.com/lists/oss-security/2010/08/31/6
[4] http://www.openwall.com/lists/oss-security/2010/08/31/7
[5] http://www.openwall.com/lists/oss-security/2010/09/02/2
[6] http://www.openwall.com/lists/oss-security/2010/09/02/3
[7] http://www.openwall.com/lists/oss-security/2010/09/02/4
[8] http://www.openwall.com/lists/oss-security/2010/09/02/5
Comment 4 Josh Bressers 2011-02-02 21:02:22 UTC 
Statement:

The Red Hat Security Response Team has rated this issue as having low security
impact. We do not currently plan to fix this flaw. If more information becomes available at a future date, we may revisit the issue.
Comment 5 Tomas Hoger 2011-02-04 19:21:44 UTC 
Upstream bug for this issue, resolved as wontfix:
  http://sourceware.org/bugzilla/show_bug.cgi?id=12189