RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1246713 - CVE-2015-5229 glibc: calloc() returns non-zero'ed memory
Summary: CVE-2015-5229 glibc: calloc() returns non-zero'ed memory
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: glibc
Version: 6.7
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Siddhesh Poyarekar
QA Contact: qe-baseos-tools-bugs
URL:
Whiteboard:
Depends On: 1245731
Blocks: CVE-2015-5229 1293976 1294080
TreeView+ depends on / blocked
 
Reported: 2015-07-25 01:34 UTC by Josef Bacik
Modified: 2016-06-21 19:03 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1256288 1293976 1294080 (view as bug list)
Environment:
Last Closed: 2015-08-24 09:58:22 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
patch to fix the problem. (1.35 KB, patch)
2015-07-25 01:34 UTC, Josef Bacik 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1255822 0 unspecified CLOSED glibc: malloc may fall back to calling mmap prematurely if arenas are contended 2021-02-22 00:41:40 UTC
Red Hat Bugzilla 1348620 0 unspecified CLOSED glibc: malloc may fall back to calling mmap prematurely if arenas are contended 2021-02-22 00:41:40 UTC
Sourceware 20284 0 None None None 2019-04-08 15:48:41 UTC

Internal Links: 1255822 1348620

Description Josef Bacik 2015-07-25 01:34:00 UTC 
Created attachment 1055966 [details]
patch to fix the problem.

Description of problem:
At Facebook we had an app that started hanging and crashing weirdly when going from glibc-2.12-1.149.el6.x86_64 to glibc-2.12-1.163.el6.x86_64.  Turns out this patch

glibc-rh1066724.patch

Introduced the problem.

You added the following bit to _int_malloc()

+  /* There are no usable arenas.  Fall back to sysmalloc to get a chunk from
+     mmap.  */
+  if (__glibc_unlikely (av == NULL))
+    {
+      void *p = sYSMALLOc (nb, av);
+      if (p != NULL)
+       alloc_perturb (p, bytes);
+      return p;
+    }
+

But this isn't ok, alloc_perturb unconditionally memset's the front byte to 0xf, unlike upstream where it checks to see if perturb_byte is set.  This needs to be changed to

if (p != NULL && && __builtin_expect(perturb_byte, 0))
   alloc_perturb (p, bytes);
return p;

The patch I've attached fixes the problem for me.

This problem is exacerbated by the fact that any sort of lock contention on the arena's results in us falling back on mmap()'ing a new chunk.  This is because we check to see if the uncontended arena we check is corrupt, and if it is we loop through, and if we loop to the beginning we know we didn't find anything.  Except if our initial arena isn't actually corrupt we'll still return NULL, so we fall back on this mmap() thing more often, which really makes things unstable.

Please get this fixed as soon as possible, I'd even go so far as to call it a possible security issue.
Comment 2 Carlos O'Donell 2015-07-25 03:11:01 UTC 
(In reply to Josef Bacik from comment #0)
> Created attachment 1055966 [details]
> patch to fix the problem.
> 
> Description of problem:
> At Facebook we had an app that started hanging and crashing weirdly when
> going from glibc-2.12-1.149.el6.x86_64 to glibc-2.12-1.163.el6.x86_64. 

Please note that there is already a RHEL 6.7.z errata that fixes this, and it was released two days ago:
https://rhn.redhat.com/errata/RHBA-2015-1465.html

Please update to glibc-2.12-1.166.el6_7.1.

One question, when you write "glibc-2.12-1.163.el6.x86_64" do you actually mean "glibc-2.12-1.166.el6.x86_64?" (note .166 not .163)?

Lastly, the robust malloc support has been backed out for the release, but we plan to put it back in as soon as we are certain we've corrected the remaining issues. Would you be interested in testing an unsupported non-production build with the new feature?
Comment 5 Josef Bacik 2015-07-25 15:44:01 UTC 
We're on Centos, not RHEL, we just happened to end up with the .163 release (I'm not sure how) before 6.7 was released.  Give me whatever package you want me to test, we don't care about unsupported, obviously we are capable of supporting ourselves ;).  I do need to have an src.rpm tho so I can build and test it on our systems and verify the issue I was seeing is actually fixed.
Comment 8 Carlos O'Donell 2015-08-04 18:59:49 UTC 
(In reply to Josef Bacik from comment #5)
> We're on Centos, not RHEL, we just happened to end up with the .163 release
> (I'm not sure how) before 6.7 was released.  Give me whatever package you
> want me to test, we don't care about unsupported, obviously we are capable
> of supporting ourselves ;).  I do need to have an src.rpm tho so I can build
> and test it on our systems and verify the issue I was seeing is actually
> fixed.

Sounds good. We'll get you something when we're ready. Thanks for agreeing to test :-)
Comment 11 Siddhesh Poyarekar 2015-08-20 04:43:00 UTC 
Removing the "already fixed in 6.7.z" from the title because it confused me the couple of times I read it.
Comment 17 Florian Weimer 2015-08-24 09:58:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHBA-2015:1465 https://rhn.redhat.com/errata/RHBA-2015-1465.html


The SRPM is available here: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/glibc-2.12-1.166.el6_7.1.src.rpm
Note You need to log in before you can comment on or make changes to this bug.