oss-security - Re: Out-of-bounds read & write in the glibc's qsort()

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 5 Feb 2024 16:45:55 +0800
From: "Alexander E. Patrakov" <patrakov@...il.com>
To: oss-security@...ts.openwall.com
Cc: Qualys Security Advisory <qsa@...lys.com>, Adhemerval Zanella <adhemerval.zanella@...aro.org>
Subject: Re: Out-of-bounds read & write in the glibc's qsort()

On Mon, Feb 5, 2024 at 4:40 PM Alexander E. Patrakov <patrakov@...il.com> wrote:
>
> On Mon, Feb 5, 2024 at 12:36 AM Solar Designer <solar@...nwall.com> wrote:
>
> > It's so invasive I cannot easily tell whether qsort() remained robust
> > after it or not.  There's no longer a "tmp_ptr != base_ptr &&" check.
> > So, lacking known-working tests in glibc tree, we don't know about glibc
> > 2.39's status with respect to this issue.
> >
> > I don't have a glibc 2.39 build handy.  Perhaps someone on a distro that
> > has already updated can run the attached test program and let us know?
>
> Here you go: no output on Arch Linux.
>
> [aep@...-haswell tmp]$ gcc ./glibc-qualys-rocky-qsort-test.c
> [aep@...-haswell tmp]$ ./a.out
> [aep@...-haswell tmp]$ /lib64/libc.so.6
> GNU C Library (GNU libc) stable release version 2.39.
> Copyright (C) 2024 Free Software Foundation, Inc.
> This is free software; see the source for copying conditions.
> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
> PARTICULAR PURPOSE.
> Compiled by GNU CC version 13.2.1 20230801.
> libc ABIs: UNIQUE IFUNC ABSOLUTE
> Minimum supported kernel: 4.4.0
> For bug reporting instructions, please see:
> <https://gitlab.archlinux.org/archlinux/packaging/packages/glibc/-/issues>.
>
> --
> Alexander E. Patrakov

Sorry, I should have followed the instructions.

[aep@...-haswell tmp]$ while true; do n=$((RANDOM*64+RANDOM+1));
prlimit --as=$((n*4/2*3)) ./a.out $n; done

This results in a mix of these outputs:

PASSED
./a.out: error while loading shared libraries: libc.so.6: failed to
map segment from shared object
Segmentation fault

-- 
Alexander E. Patrakov

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.