| Brad Bishop | d7bf8c1 | 2018-02-25 22:55:05 -0500 | [diff] [blame] | 1 | From a76376df7c07e577a9515c3faa5dbd50bda5da07 Mon Sep 17 00:00:00 2001 |
| 2 | From: Paul Eggert <eggert@cs.ucla.edu> |
| 3 | Date: Fri, 20 Oct 2017 18:41:14 +0200 |
| 4 | Subject: [PATCH] CVE-2017-15670: glob: Fix one-byte overflow [BZ #22320] |
| 5 | |
| 6 | (cherry picked from commit c369d66e5426a30e4725b100d5cd28e372754f90) |
| 7 | |
| 8 | Upstream-Status: Backport |
| 9 | CVE: CVE-2017-15670 |
| 10 | Affects: glibc < 2.27 |
| 11 | Signed-off-by: Armin Kuster <akuster@mvista.com> |
| 12 | |
| 13 | --- |
| 14 | ChangeLog | 6 ++++++ |
| 15 | NEWS | 5 +++++ |
| 16 | posix/glob.c | 2 +- |
| 17 | 3 files changed, 12 insertions(+), 1 deletion(-) |
| 18 | |
| 19 | Index: git/NEWS |
| 20 | =================================================================== |
| 21 | --- git.orig/NEWS |
| 22 | +++ git/NEWS |
| 23 | @@ -206,6 +206,11 @@ Security related changes: |
| 24 | * A use-after-free vulnerability in clntudp_call in the Sun RPC system has been |
| 25 | fixed (CVE-2017-12133). |
| 26 | |
| 27 | + CVE-2017-15670: The glob function, when invoked with GLOB_TILDE, |
| 28 | + suffered from a one-byte overflow during ~ operator processing (either |
| 29 | + on the stack or the heap, depending on the length of the user name). |
| 30 | + Reported by Tim RΓΌhsen. |
| 31 | + |
| 32 | The following bugs are resolved with this release: |
| 33 | |
| 34 | [984] network: Respond to changed resolv.conf in gethostbyname |
| 35 | Index: git/posix/glob.c |
| 36 | =================================================================== |
| 37 | --- git.orig/posix/glob.c |
| 38 | +++ git/posix/glob.c |
| 39 | @@ -843,7 +843,7 @@ glob (const char *pattern, int flags, in |
| 40 | *p = '\0'; |
| 41 | } |
| 42 | else |
| 43 | - *((char *) mempcpy (newp, dirname + 1, end_name - dirname)) |
| 44 | + *((char *) mempcpy (newp, dirname + 1, end_name - dirname - 1)) |
| 45 | = '\0'; |
| 46 | user_name = newp; |
| 47 | } |
| 48 | Index: git/ChangeLog |
| 49 | =================================================================== |
| 50 | --- git.orig/ChangeLog |
| 51 | +++ git/ChangeLog |
| 52 | @@ -1,3 +1,9 @@ |
| 53 | +2017-10-20 Paul Eggert <eggert@cs.ucla.edu> |
| 54 | + |
| 55 | + [BZ #22320] |
| 56 | + CVE-2017-15670 |
| 57 | + * posix/glob.c (__glob): Fix one-byte overflow. |
| 58 | + |
| 59 | 2017-08-02 Siddhesh Poyarekar <siddhesh@sourceware.org> |
| 60 | |
| 61 | * version.h (RELEASE): Set to "stable" |