1. photon
  2. Commit 80c8746a023fd9cdc41085b9dc47b05322a74bd2
Browse code

Fix for CVE-2017-18269 in glibc

Change-Id: I12d008558a70d9617f0e3dafefb1f80ea1c1f106
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/5294
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Srivatsa S. Bhat <srivatsab@vmware.com>

Keerthana K authored on 2018/06/26 04:26:33
Showing 2 changed files
SPECS/glibc/glibc-fix-CVE-2017-18269.patch
History View file @ 80c8746
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,158 @@
0 
+From cd66c0e584c6d692bc8347b5e72723d02b8a8ada Mon Sep 17 00:00:00 2001
1 
+From: Andrew Senkevich <andrew.n.senkevich@gmail.com>
2 
+Date: Fri, 23 Mar 2018 16:19:45 +0100
3 
+Subject: [PATCH] Fix i386 memmove issue (bug 22644).
4 
+
5 
+	[BZ #22644]
6 
+	* sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S: Fixed
7 
+	branch conditions.
8 
+	* string/test-memmove.c (do_test2): New testcase.
9 
+---
10 
+ ChangeLog                                          |  8 +++
11 
+ string/test-memmove.c                              | 58 ++++++++++++++++++++++
12 
+ .../i386/i686/multiarch/memcpy-sse2-unaligned.S    | 12 ++---
13 
+ 3 files changed, 72 insertions(+), 6 deletions(-)
14 
+
15 
+diff --git a/string/test-memmove.c b/string/test-memmove.c
16 
+index edc7a4c..64e3651 100644
17 
+--- a/string/test-memmove.c
18 
+@@ -24,6 +24,7 @@
19 
+ # define TEST_NAME "memmove"
20 
+ #endif
21 
+ #include "test-string.h"
22 
++#include <support/test-driver.h>
23 
+
24 
+ char *simple_memmove (char *, const char *, size_t);
25 
+
26 
+@@ -245,6 +246,60 @@ do_random_tests (void)
27 
+     }
28 
+ }
29 
+
30 
++static void
31 
++do_test2 (void)
32 
++{
33 
++  size_t size = 0x20000000;
34 
++  uint32_t * large_buf;
35 
++
36 
++  large_buf = mmap ((void*) 0x70000000, size, PROT_READ | PROT_WRITE,
37 
++		    MAP_PRIVATE | MAP_ANON, -1, 0);
38 
++
39 
++  if (large_buf == MAP_FAILED)
40 
++    error (EXIT_UNSUPPORTED, errno, "Large mmap failed");
41 
++
42 
++  if ((uintptr_t) large_buf > 0x80000000 - 128
43 
++      || 0x80000000 - (uintptr_t) large_buf > 0x20000000)
44 
++    {
45 
++      error (0, 0, "Large mmap allocated improperly");
46 
++      ret = EXIT_UNSUPPORTED;
47 
++      munmap ((void *) large_buf, size);
48 
++      return;
49 
++    }
50 
++
51 
++  size_t bytes_move = 0x80000000 - (uintptr_t) large_buf;
52 
++  size_t arr_size = bytes_move / sizeof (uint32_t);
53 
++  size_t i;
54 
++
55 
++  FOR_EACH_IMPL (impl, 0)
56 
++    {
57 
++      for (i = 0; i < arr_size; i++)
58 
++        large_buf[i] = (uint32_t) i;
59 
++
60 
++      uint32_t * dst = &large_buf[33];
61 
++
62 
++#ifdef TEST_BCOPY
63 
++      CALL (impl, (char *) large_buf, (char *) dst, bytes_move);
64 
++#else
65 
++      CALL (impl, (char *) dst, (char *) large_buf, bytes_move);
66 
++#endif
67 
++
68 
++      for (i = 0; i < arr_size; i++)
69 
++	{
70 
++	  if (dst[i] != (uint32_t) i)
71 
++	    {
72 
++	      error (0, 0,
73 
++		     "Wrong result in function %s dst \"%p\" src \"%p\" offset \"%zd\"",
74 
++		     impl->name, dst, large_buf, i);
75 
++	      ret = 1;
76 
++	      break;
77 
++	    }
78 
++	}
79 
++    }
80 
++
81 
++  munmap ((void *) large_buf, size);
82 
++}
83 
++
84 
+ int
85 
+ test_main (void)
86 
+ {
87 
+@@ -284,6 +339,9 @@ test_main (void)
88 
+     }
89 
+
90 
+   do_random_tests ();
91 
++
92 
++  do_test2 ();
93 
++
94 
+   return ret;
95 
+ }
96 
+
97 
+diff --git a/sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S b/sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S
98 
+index 9c3bbe7..9aa17de 100644
99 
+--- a/sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S
100 
+@@ -72,7 +72,7 @@ ENTRY (MEMCPY)
101 
+ 	cmp	%edx, %eax
102 
+
103 
+ # ifdef USE_AS_MEMMOVE
104 
+-	jg	L(check_forward)
105 
++	ja	L(check_forward)
106 
+
107 
+ L(mm_len_0_or_more_backward):
108 
+ /* Now do checks for lengths. We do [0..16], [16..32], [32..64], [64..128]
109 
+@@ -81,7 +81,7 @@ L(mm_len_0_or_more_backward):
110 
+ 	jbe	L(mm_len_0_16_bytes_backward)
111 
+
112 
+ 	cmpl	$32, %ecx
113 
+-	jg	L(mm_len_32_or_more_backward)
114 
++	ja	L(mm_len_32_or_more_backward)
115 
+
116 
+ /* Copy [0..32] and return.  */
117 
+ 	movdqu	(%eax), %xmm0
118 
+@@ -92,7 +92,7 @@ L(mm_len_0_or_more_backward):
119 
+
120 
+ L(mm_len_32_or_more_backward):
121 
+ 	cmpl	$64, %ecx
122 
+-	jg	L(mm_len_64_or_more_backward)
123 
++	ja	L(mm_len_64_or_more_backward)
124 
+
125 
+ /* Copy [0..64] and return.  */
126 
+ 	movdqu	(%eax), %xmm0
127 
+@@ -107,7 +107,7 @@ L(mm_len_32_or_more_backward):
128 
+
129 
+ L(mm_len_64_or_more_backward):
130 
+ 	cmpl	$128, %ecx
131 
+-	jg	L(mm_len_128_or_more_backward)
132 
++	ja	L(mm_len_128_or_more_backward)
133 
+
134 
+ /* Copy [0..128] and return.  */
135 
+ 	movdqu	(%eax), %xmm0
136 
+@@ -132,7 +132,7 @@ L(mm_len_128_or_more_backward):
137 
+ 	add	%ecx, %eax
138 
+ 	cmp	%edx, %eax
139 
+ 	movl	SRC(%esp), %eax
140 
+-	jle	L(forward)
141 
++	jbe	L(forward)
142 
+ 	PUSH (%esi)
143 
+ 	PUSH (%edi)
144 
+ 	PUSH (%ebx)
145 
+@@ -269,7 +269,7 @@ L(check_forward):
146 
+ 	add	%edx, %ecx
147 
+ 	cmp	%eax, %ecx
148 
+ 	movl	LEN(%esp), %ecx
149 
+-	jle	L(forward)
150 
++	jbe	L(forward)
151 
+
152 
+ /* Now do checks for lengths. We do [0..16], [0..32], [0..64], [0..128]
153 
+ 	separately.  */
154 
+--
155 
+2.9.3
SPECS/glibc/glibc.spec
History View file @ 80c8746
... ... 
@@ -6,7 +6,7 @@
6 6 
 Summary:        Main C library
7 7 
 Name:           glibc
8 8 
 Version:        2.22
9 
-Release:        19%{?dist}
9 
+Release:        20%{?dist}
10 10 
 License:        LGPLv2+
11 11 
 URL:            http://www.gnu.org/software/libc
12 12 
 Group:          Applications/System
... ... 
@@ -48,6 +48,7 @@ Patch20:        glibc-2.22-CVE-2016-5417.patch
48 48 
 Patch21:        glibc-fix-CVE-2017-16997.patch
49 49 
 Patch22:        glibc-fix-CVE-2018-1000001.patch
50 50 
 Patch23:        glibc-fix-CVE-2018-6485.patch
51 
+Patch24:        glibc-fix-CVE-2017-18269.patch
51 52 
 Provides:       rtld(GNU_HASH)
52 53 
 Requires:       filesystem
53 54 
 %description
... ... 
@@ -97,6 +98,7 @@ sed -i 's/\\$$(pwd)/`pwd`/' timezone/Makefile
97 97 
 %patch21 -p1
98 98 
 %patch22 -p1
99 99 
 %patch23 -p1
100 
+%patch24 -p1
100 101 
 install -vdm 755 %{_builddir}/%{name}-build
101 102 
 # do not try to explicitly provide GLIBC_PRIVATE versioned libraries
102 103 
 %define __find_provides %{_builddir}/%{name}-%{version}/find_provides.sh
... ... 
@@ -223,6 +225,8 @@ popd
223 223 
 %{_datarootdir}/locale/locale.alias
224 224
225 225 
 %changelog
226 
+*   Mon Jun 25 2018 Keerthana K <keerthanak@vmware.com> 2.22-20
227 
+-   Fix for CVE-2017-18269.
226 228 
 *   Tue Jan 20 2018 Xiaolin Li <xiaolinl@vmware.com> 2.22-19
227 229 
 -   Fix CVE-2018-1000001 and CVE-2018-6485
228 230 
 *   Mon Jan 08 2018 Xiaolin Li <xiaolinl@vmware.com> 2.22-18