Bug 2338960 - glibc: getrandom, arc4random can return predictable data after fork (CVE-2025-0577)
Summary: glibc: getrandom, arc4random can return predictable data after fork (CVE-2025...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: glibc
Version: 40
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Carlos O'Donell
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-01-20 07:52 UTC by Florian Weimer
Modified: 2025-01-27 06:44 UTC (History)
14 users (show)

Fixed In Version: glibc-2.39-37.fc40 glibc-2.40-20.fc41 glibc-2.40.9000-30.fc42
Clone Of:
Environment:
Last Closed: 2025-01-27 06:44:08 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Florian Weimer 2025-01-20 07:52:01 UTC
Upstream fixed the following security vulnerability during glibc 2.41 development. There is no upstream advisory because the issue was caught during development. However, we have backported getrandom vDSO acceleration to Fedora 40, so we need downstream security advisories.

commit abeae3c0061c0599ac2f012b270d6b4c8f59c82f
Author: Florian Weimer <fweimer>
Date:   Thu Jan 16 18:45:25 2025 +0100

    Linux: Fixes for getrandom fork handling
    
    Careful updates of grnd_alloc.len are required to ensure that
    after fork, grnd_alloc.states does not contain entries that
    are also encountered by __getrandom_reset_state in TCBs.
    For the same reason, it is necessary to overwrite the TCB state
    pointer with NULL before updating grnd_alloc.states in
    __getrandom_vdso_release.
    
    Before this change, different TCBs could share the same getrandom
    state after multi-threaded fork.  This would be a critical security
    bug (predictable randomness) if not caught during development.
    
    The additional check in stdlib/tst-arc4random-thread makes it more
    likely that the test fails due to the bugs mentioned above.
    
    Both __getrandom_reset_state and __getrandom_vdso_release could
    put reserved NULL pointers into the states array.  This is also
    fixed with this commit.  After these changes, no null pointers were
    observed in the states array during testing.
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella>


Reproducible: Always

Comment 2 Fedora Update System 2025-01-25 18:27:07 UTC
FEDORA-2025-497995b101 (glibc-2.40-21.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-497995b101

Comment 3 Fedora Update System 2025-01-25 18:33:36 UTC
FEDORA-2025-69207650a4 (glibc-2.39-37.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-69207650a4

Comment 4 Fedora Update System 2025-01-26 02:26:10 UTC
FEDORA-2025-497995b101 has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-497995b101`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-497995b101

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2025-01-26 18:54:11 UTC
FEDORA-2025-69207650a4 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-69207650a4`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-69207650a4

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2025-01-27 01:39:07 UTC
FEDORA-2025-497995b101 (glibc-2.40-21.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Fedora Update System 2025-01-27 01:55:29 UTC
FEDORA-2025-69207650a4 (glibc-2.39-37.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.