Bug 838050 - [RFE] glibc: warn() and other functions are not protected by FORTIFY_SOURCE format string protection
Summary: [RFE] glibc: warn() and other functions are not protected by FORTIFY_SOURCE f...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: glibc
Version: 7.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Carlos O'Donell
QA Contact: qe-baseos-tools
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-07-06 09:23 UTC by Stefan Cornelius
Modified: 2016-11-24 16:08 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-09-06 17:26:18 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Sourceware 14334 None None None 2019-08-07 11:28:00 UTC

Description Stefan Cornelius 2012-07-06 09:23:00 UTC
Description of problem:
Huzaifa S. Sidhpurwala of SRT noticed that some functions using formatted printing (e.g. "warn()", "err()", and "warnx()") are not protected by the fortify source format string protection. The relevant functions were never meant to be protected by fortify source, so from a security point of view, this is an enhancement only. Since fixing this would break the ABI, we need to work with upstream to see if a protection for these functions can be included in future versions.

Description from the original bug #836931:
While looking into some format string issue, i found that the warn() function does not seem to be protected by the glibc FORTIFY_SOURCE Format string protection mechanism.

Here is a simple example to prove my point:

[huzaifas@babylon ~]$ cat warn1.c 
#include <stdio.h>
#include <err.h>

void main(int argc, char *argv[])
{
warn(argv[1]);
//printf(argv[1]);
}

[huzaifas@babylon ~]$ gcc -O -g -D_FORTIFY_SOURCE=2 -o warn warn1.c
[huzaifas@babylon ~]$ cat print.c 
#include <stdio.h>
#include <err.h>

void main(int argc, char *argv[])
{
//warn(argv[1]);
printf(argv[1]);
}
[huzaifas@babylon ~]$ gcc -O -g -D_FORTIFY_SOURCE=2 -o print print.c

[huzaifas@babylon ~]$ ./warn "%100s%n"
warn:                                                                                               ?&#9646;&#65533;: Segmentation fault
[huzaifas@babylon ~]$ ./print "%100s%n"
*** %n in writable segment detected ***
                                                                                              L&#65533;|&#65533;Aborted
[huzaifas@babylon ~]$

Comment 2 Jeff Law 2012-07-06 16:28:02 UTC
It might be interesting to do an audit and see if anything is actually using those functions.  I'd be a bit surprised given they're really outside the standard and better functions exist within the standard to handle this stuf

Jeff

Comment 3 Stefan Cornelius 2012-07-09 11:26:05 UTC
*** Bug 836931 has been marked as a duplicate of this bug. ***

Comment 4 Mark J. Cox 2012-07-30 13:18:48 UTC
This request is due https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1151 where we had to fix a format string flaw in a RHEL package because of the lack of warn() fortification and ended up having to do an impact=important RHSA

Comment 5 Jeff Law 2012-08-03 17:56:32 UTC
Thanks Mark.  Amazing to find code using these bogus interfaces.

Any thoughts on doing an audit of the RHEL packages & libraries for other instances that are using these bogus interfaces?  In theory, it's just "nm" piped to "grep" across everything in RHEL.

Jeff

Comment 12 RHEL Product and Program Management 2013-09-06 17:26:18 UTC
Development Management has reviewed and declined this request.
You may appeal this decision by reopening this request.


Note You need to log in before you can comment on or make changes to this bug.