Bug 1452543 (CVE-2017-1000366) - CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations
Summary: CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-1000366
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1452674 1452709 1452710 1452711 1452712 1452713 1452714 1452715 1452716 1452717 1452718 1452720 1452721 1462820 1462923
Blocks: 1449010
TreeView+ depends on / blocked
 
Reported: 2017-05-19 07:41 UTC by Petr Matousek
Modified: 2021-02-17 02:08 UTC (History)
32 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult.
Clone Of:
Environment:
Last Closed: 2017-06-27 20:44:02 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1479 0 normal SHIPPED_LIVE Important: glibc security update 2017-06-20 00:12:32 UTC
Red Hat Product Errata RHSA-2017:1480 0 normal SHIPPED_LIVE Important: glibc security update 2017-06-19 23:36:59 UTC
Red Hat Product Errata RHSA-2017:1481 0 normal SHIPPED_LIVE Important: glibc security update 2017-06-19 22:49:07 UTC
Red Hat Product Errata RHSA-2017:1567 0 normal SHIPPED_LIVE Important: Red Hat Container Development Kit 3.0.0 security update 2017-06-21 19:11:05 UTC
Sourceware 21624 0 P1 RESOLVED ld.so: Unsafe alloca allows local attackers to alias stack and heap (CVE-2017-1000366) 2020-01-23 19:31:19 UTC

Description Petr Matousek 2017-05-19 07:41:37 UTC 
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the heap/stack gap, cause controlled memory corruption on process stack or heap, and thus increase their privileges on the system.

This is a tracking bug for the glibc part of the mitigation.
Comment 21 Petr Matousek 2017-06-14 08:50:34 UTC 
Acknowledgments:

Name: Qualys Research Labs
Comment 36 Petr Matousek 2017-06-16 18:41:12 UTC 
External References:

https://access.redhat.com/security/vulnerabilities/stackguard
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
Comment 37 Petr Matousek 2017-06-19 15:47:03 UTC 
Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1462820]
Comment 39 errata-xmlrpc 2017-06-19 18:49:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1481 https://access.redhat.com/errata/RHSA-2017:1481
Comment 40 errata-xmlrpc 2017-06-19 19:37:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:1480 https://access.redhat.com/errata/RHSA-2017:1480
Comment 41 errata-xmlrpc 2017-06-19 20:17:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5 Extended Lifecycle Support
  Red Hat Enterprise Linux 5.9 Long Life
  Red Hat Enterprise Linux 6.2 Advanced Update Support
  Red Hat Enterprise Linux 6.4 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Telco Extended Update Support
  Red Hat Enterprise Linux 6.6 Advanced Update Support
  Red Hat Enterprise Linux 6.6 Telco Extended Update Support
  Red Hat Enterprise Linux 6.7 Extended Update Support
  Red Hat Enterprise Linux 7.2 Extended Update Support

Via RHSA-2017:1479 https://access.redhat.com/errata/RHSA-2017:1479
Comment 42 errata-xmlrpc 2017-06-21 15:11:56 UTC 
This issue has been addressed in the following products:

  CDK 3.0

Via RHSA-2017:1567 https://access.redhat.com/errata/RHSA-2017:1567
Comment 43 Petr Matousek 2017-08-25 09:01:11 UTC 
Statement:

This is a glibc-side mitigation. For a related kernel mitigation please see https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-1000364 .
Note You need to log in before you can comment on or make changes to this bug.