Bug 1246713 - CVE-2015-5229 glibc: calloc() returns non-zero'ed memory
CVE-2015-5229 glibc: calloc() returns non-zero'ed memory
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: glibc (Show other bugs)
6.7
All Linux
medium Severity medium
: rc
: ---
Assigned To: Siddhesh Poyarekar
qe-baseos-tools
: Security
Depends On: 1245731
Blocks: CVE-2015-5229 1293976 1294080
  Show dependency treegraph
 
Reported: 2015-07-24 21:34 EDT by Josef Bacik
Modified: 2016-06-21 15:03 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1256288 1293976 1294080 (view as bug list)
Environment:
Last Closed: 2015-08-24 05:58:22 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
patch to fix the problem. (1.35 KB, patch)
2015-07-24 21:34 EDT, Josef Bacik
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Sourceware 20284 None None None 2016-06-21 10:50 EDT

  None (edit)
Description Josef Bacik 2015-07-24 21:34:00 EDT
Created attachment 1055966 [details]
patch to fix the problem.

Description of problem:
At Facebook we had an app that started hanging and crashing weirdly when going from glibc-2.12-1.149.el6.x86_64 to glibc-2.12-1.163.el6.x86_64.  Turns out this patch

glibc-rh1066724.patch

Introduced the problem.

You added the following bit to _int_malloc()

+  /* There are no usable arenas.  Fall back to sysmalloc to get a chunk from
+     mmap.  */
+  if (__glibc_unlikely (av == NULL))
+    {
+      void *p = sYSMALLOc (nb, av);
+      if (p != NULL)
+       alloc_perturb (p, bytes);
+      return p;
+    }
+

But this isn't ok, alloc_perturb unconditionally memset's the front byte to 0xf, unlike upstream where it checks to see if perturb_byte is set.  This needs to be changed to

if (p != NULL && && __builtin_expect(perturb_byte, 0))
   alloc_perturb (p, bytes);
return p;

The patch I've attached fixes the problem for me.

This problem is exacerbated by the fact that any sort of lock contention on the arena's results in us falling back on mmap()'ing a new chunk.  This is because we check to see if the uncontended arena we check is corrupt, and if it is we loop through, and if we loop to the beginning we know we didn't find anything.  Except if our initial arena isn't actually corrupt we'll still return NULL, so we fall back on this mmap() thing more often, which really makes things unstable.

Please get this fixed as soon as possible, I'd even go so far as to call it a possible security issue.
Comment 2 Carlos O'Donell 2015-07-24 23:11:01 EDT
(In reply to Josef Bacik from comment #0)
> Created attachment 1055966 [details]
> patch to fix the problem.
> 
> Description of problem:
> At Facebook we had an app that started hanging and crashing weirdly when
> going from glibc-2.12-1.149.el6.x86_64 to glibc-2.12-1.163.el6.x86_64. 

Please note that there is already a RHEL 6.7.z errata that fixes this, and it was released two days ago:
https://rhn.redhat.com/errata/RHBA-2015-1465.html

Please update to glibc-2.12-1.166.el6_7.1.

One question, when you write "glibc-2.12-1.163.el6.x86_64" do you actually mean "glibc-2.12-1.166.el6.x86_64?" (note .166 not .163)?

Lastly, the robust malloc support has been backed out for the release, but we plan to put it back in as soon as we are certain we've corrected the remaining issues. Would you be interested in testing an unsupported non-production build with the new feature?
Comment 5 Josef Bacik 2015-07-25 11:44:01 EDT
We're on Centos, not RHEL, we just happened to end up with the .163 release (I'm not sure how) before 6.7 was released.  Give me whatever package you want me to test, we don't care about unsupported, obviously we are capable of supporting ourselves ;).  I do need to have an src.rpm tho so I can build and test it on our systems and verify the issue I was seeing is actually fixed.
Comment 8 Carlos O'Donell 2015-08-04 14:59:49 EDT
(In reply to Josef Bacik from comment #5)
> We're on Centos, not RHEL, we just happened to end up with the .163 release
> (I'm not sure how) before 6.7 was released.  Give me whatever package you
> want me to test, we don't care about unsupported, obviously we are capable
> of supporting ourselves ;).  I do need to have an src.rpm tho so I can build
> and test it on our systems and verify the issue I was seeing is actually
> fixed.

Sounds good. We'll get you something when we're ready. Thanks for agreeing to test :-)
Comment 11 Siddhesh Poyarekar 2015-08-20 00:43:00 EDT
Removing the "already fixed in 6.7.z" from the title because it confused me the couple of times I read it.
Comment 17 Florian Weimer 2015-08-24 05:58:22 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHBA-2015:1465 https://rhn.redhat.com/errata/RHBA-2015-1465.html


The SRPM is available here: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/glibc-2.12-1.166.el6_7.1.src.rpm

Note You need to log in before you can comment on or make changes to this bug.