Bug 1983750
| Summary: | CVE-2014-4043 glibc: Fix path argument copying for posix_spawn_file_actions_addopen | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Andrew Haley <aph> |
| Component: | glibc | Assignee: | glibc team <glibc-bugzilla> |
| Status: | CLOSED WONTFIX | QA Contact: | qe-baseos-tools-bugs |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.6 | CC: | ashankar, cnutter, codonell, dj, fweimer, mnewsome, pfrankli, sipoyare |
| Target Milestone: | rc | Keywords: | Bugfix, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-08-25 13:57:32 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Comment 6
Charles Oliver Nutter
2021-08-11 16:42:06 UTC
(In reply to Charles Oliver Nutter from comment #6) > I have pushed a fix for jnr-posix to use a direct ByteBuffer as a defensive > copy before passing the path out to posix_spawn_file_actions_addopen. I > believe this will prevent the native path buffer from being deallocated > until well after the posix_spawn call has completed. > > Please confirm: https://github.com/jnr/jnr-posix/pull/171 Thanks for coming up with a workaround. I commented on the pull request. I think we originally reviewed this change for RHEL 7 and concluded that applications out there might rely on the fact that the pathname is NOT copied, which is why we declined to fix this bug. I think changing the behavior in 7.9.z is too risky at this point, so I'm closing this bug. (In reply to Florian Weimer from comment #7) > Thanks for coming up with a workaround. I commented on the pull request. I am responding to your comments and will do further updates on the PR. Thanks! > I think we originally reviewed this change for RHEL 7 and concluded that > applications out there might rely on the fact that the pathname is NOT > copied, which is why we declined to fix this bug. I think changing the > behavior in 7.9.z is too risky at this point, so I'm closing this bug. Perhaps I am missing some detail, but how would the lack of copying be externally visible, other than at a memory level? (In reply to Charles Oliver Nutter from comment #8) > > I think we originally reviewed this change for RHEL 7 and concluded that > > applications out there might rely on the fact that the pathname is NOT > > copied, which is why we declined to fix this bug. I think changing the > > behavior in 7.9.z is too risky at this point, so I'm closing this bug. > > Perhaps I am missing some detail, but how would the lack of copying be > externally visible, other than at a memory level? The lack of copying could be used to launch different processes with different open files, by mutating the pathname argument in place after calling posix_spawn_file_actions_addopen (and reusing the specified file actions list). > The lack of copying could be used to launch different processes with different open files, by mutating the pathname argument in place after calling posix_spawn_file_actions_addopen (and reusing the specified file actions list).
Well, that's kinda scary, but I understand. Thank you for the clarification!
The workaround in jnr-posix has been released in 3.1.8.
We're fone here. Wontfix. |