Bug 1774681 (CVE-2019-19126) - CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries
Summary: CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries
Keywords:
Status: NEW
Alias: CVE-2019-19126
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1774021 1774682 1775599 1775600
Blocks: 1774683
TreeView+ depends on / blocked
 
Reported: 2019-11-20 17:09 UTC by Guilherme de Almeida Suckevicz
Modified: 2019-12-17 03:18 UTC (History)
15 users (show)

Fixed In Version: glibc 2.31
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to force system to utilize only half of the memory (making the system think the software is 32-bit only), thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest threat is confidentiality although the complexity of attack is high. The affected application must already have other vulnerabilities for this flaw to be usable.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2019-11-20 17:09:15 UTC
On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=25204

Comment 1 Riccardo Schirone 2019-11-21 17:12:27 UTC
LD_PREFER_MAP_32BIT_EXEC is an environment variable that can be set to let the dynamic linker first try to map executable pages using the mmap flag MAP_32BIT, which will map to the low 2 GB of the address space. According to the documentation, LD_PREFER_MAP_32BIT_EXEC should be disabled for setuid binaries, however the code using it (https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/x86_64/64/dl-librecon.h;h=0e95221908b07eb29c33deda31e6e830ae151fbe;hb=2a764c6ee848dfe92cb2921ed3b14085f15d9e79#l32) is run before the code that removes security-sensitive environment variables.


Note You need to log in before you can comment on or make changes to this bug.