Red Hat Bugzilla – Bug 643396
CVE-2010-3192 glibc: __fortify_fail may use corrupted memory when called from SSP callback
Last modified: 2016-02-04 01:47:11 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-3192 to the following vulnerability: Certain run-time memory protection mechanisms in the GNU C Library (aka glibc or libc6) print argv[0] and backtrace information, which might allow context-dependent attackers to obtain sensitive information from process memory by executing an incorrect program, as demonstrated by a setuid program that contains a stack-based buffer overflow error, related to the __fortify_fail function in debug/fortify_fail.c, and the __stack_chk_fail (aka stack protection) and __chk_fail (aka FORTIFY_SOURCE) implementations. References: [1] http://seclists.org/fulldisclosure/2010/Apr/399 [2] http://www.openwall.com/lists/oss-security/2010/08/25/8 [3] http://www.openwall.com/lists/oss-security/2010/08/31/6 [4] http://www.openwall.com/lists/oss-security/2010/08/31/7 [5] http://www.openwall.com/lists/oss-security/2010/09/02/2 [6] http://www.openwall.com/lists/oss-security/2010/09/02/3 [7] http://www.openwall.com/lists/oss-security/2010/09/02/4 [8] http://www.openwall.com/lists/oss-security/2010/09/02/5
Statement: The Red Hat Security Response Team has rated this issue as having low security impact. We do not currently plan to fix this flaw. If more information becomes available at a future date, we may revisit the issue.
Upstream bug for this issue, resolved as wontfix: http://sourceware.org/bugzilla/show_bug.cgi?id=12189