Bug 1774681 (CVE-2019-19126) - CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries
Summary: CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries
Alias: CVE-2019-19126
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1774021 1774682 1775599 1775600
Blocks: 1774683
TreeView+ depends on / blocked
Reported: 2019-11-20 17:09 UTC by Guilherme de Almeida Suckevicz
Modified: 2020-09-29 19:20 UTC (History)
15 users (show)

Fixed In Version: glibc 2.31
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to force system to utilize only half of the memory (making the system think the software is 32-bit only), thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest threat is confidentiality although the complexity of attack is high. The affected application must already have other vulnerabilities for this flaw to be usable.
Clone Of:
Last Closed: 2020-04-28 16:34:38 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:1828 None None None 2020-04-28 15:57:57 UTC
Red Hat Product Errata RHSA-2020:3861 None None None 2020-09-29 19:20:27 UTC

Description Guilherme de Almeida Suckevicz 2019-11-20 17:09:15 UTC
On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.


Comment 1 Riccardo Schirone 2019-11-21 17:12:27 UTC
LD_PREFER_MAP_32BIT_EXEC is an environment variable that can be set to let the dynamic linker first try to map executable pages using the mmap flag MAP_32BIT, which will map to the low 2 GB of the address space. According to the documentation, LD_PREFER_MAP_32BIT_EXEC should be disabled for setuid binaries, however the code using it (https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h;h=0e95221908b07eb29c33deda31e6e830ae151fbe;hb=2a764c6ee848dfe92cb2921ed3b14085f15d9e79#l32) is run before the code that removes security-sensitive environment variables.

Comment 7 errata-xmlrpc 2020-04-28 15:57:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1828 https://access.redhat.com/errata/RHSA-2020:1828

Comment 8 Product Security DevOps Team 2020-04-28 16:34:38 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 9 errata-xmlrpc 2020-09-29 19:20:25 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3861 https://access.redhat.com/errata/RHSA-2020:3861

Note You need to log in before you can comment on or make changes to this bug.