Bug 1452543 - (CVE-2017-1000366) CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations
CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20170619,repo...
: Security
Depends On: 1452717 1452674 1452709 1452710 1452711 1452712 1452713 1452714 1452715 1452716 1452718 1452720 1452721 1462820 1462923
Blocks: 1449010
  Show dependency treegraph
 
Reported: 2017-05-19 03:41 EDT by Petr Matousek
Modified: 2017-09-05 00:21 EDT (History)
32 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-06-27 16:44:02 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Sourceware 21624 None None None 2017-06-19 11:07 EDT

  None (edit)
Description Petr Matousek 2017-05-19 03:41:37 EDT
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the heap/stack gap, cause controlled memory corruption on process stack or heap, and thus increase their privileges on the system.

This is a tracking bug for the glibc part of the mitigation.
Comment 21 Petr Matousek 2017-06-14 04:50:34 EDT
Acknowledgments:

Name: Qualys Research Labs
Comment 37 Petr Matousek 2017-06-19 11:47:03 EDT
Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1462820]
Comment 39 errata-xmlrpc 2017-06-19 14:49:42 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1481 https://access.redhat.com/errata/RHSA-2017:1481
Comment 40 errata-xmlrpc 2017-06-19 15:37:33 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:1480 https://access.redhat.com/errata/RHSA-2017:1480
Comment 41 errata-xmlrpc 2017-06-19 16:17:00 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5 Extended Lifecycle Support
  Red Hat Enterprise Linux 5.9 Long Life
  Red Hat Enterprise Linux 6.2 Advanced Update Support
  Red Hat Enterprise Linux 6.4 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Telco Extended Update Support
  Red Hat Enterprise Linux 6.6 Advanced Update Support
  Red Hat Enterprise Linux 6.6 Telco Extended Update Support
  Red Hat Enterprise Linux 6.7 Extended Update Support
  Red Hat Enterprise Linux 7.2 Extended Update Support

Via RHSA-2017:1479 https://access.redhat.com/errata/RHSA-2017:1479
Comment 42 errata-xmlrpc 2017-06-21 11:11:56 EDT
This issue has been addressed in the following products:

  CDK 3.0

Via RHSA-2017:1567 https://access.redhat.com/errata/RHSA-2017:1567
Comment 43 Petr Matousek 2017-08-25 05:01:11 EDT
Statement:

This is a glibc-side mitigation. For a related kernel mitigation please see https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-1000364 .

Note You need to log in before you can comment on or make changes to this bug.