From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS31976 209.132.180.0/23 X-Spam-Status: No, score=-2.9 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_GMAIL_RCVD, FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dcvr.yhbt.net (Postfix) with ESMTPS id 4F78B1F4C3 for ; Mon, 4 Nov 2019 11:10:16 +0000 (UTC) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:mime-version:from:date:message-id:subject:to :cc:content-type; q=dns; s=default; b=uLgBGQje+k+ygsocRREhQiuLvQ i9ZhLpajyoGLLZU9XqDYTdGZ5K6CHlFM3C2uFiK5GUvvCJpE1strX8dBGgSf3Lnx lTRWIbJIvT8kvJLGtvdGJbkvFx/IxHrgFy9eOrHYhPsMnUVY+VGkRA7mgNoIfrn3 MV+Zk9GlBT2j38lCk= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:mime-version:from:date:message-id:subject:to :cc:content-type; s=default; bh=w64craHdfX/Ge2FNj8IOy0zpBHQ=; b= TzR2F9F2IDleHBKJD1FUMVymS2Tew7CVBTBfqIfsT24+9MI1PDMHUrUraRrnRey2 5BA4Fl4bgX24L/ztUSHWIlUmmeMNpZYCnj3xR5YdRvlqUBEsgDe5w2Z3R7iKoRe9 Zw5ZvN5kQc4b02Uw+a4HYt9WyxMB/D/wt+J6T0ik590= Received: (qmail 13367 invoked by alias); 4 Nov 2019 11:10:13 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Received: (qmail 13348 invoked by uid 89); 4 Nov 2019 11:10:13 -0000 Authentication-Results: sourceware.org; auth=none X-HELO: mail-qk1-f195.google.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=oMAz4Ch0iCViBc9kUQ9fgij2oUs0hQwjsAFyKIPhOfM=; b=DckeEj8w7MkqJDVpV7p7O0q6bHySRIYzmzEegrGh7ifF34SCb6N9bf3RmUauec/Iz8 5gPZsQn9vXEooUxjRvv+0Wj2Cukg7KctBryKXzjj02/zjsgg2hJ84D5UuGY8m/zeGnZt K5Loa1Z6GhSyDdk5HZ2oAmMVpZ/RCsCdsbmD8HwzgptsL2G5zII1324zOTIPpm/NW5Qy bmQsac7D0ZwfYoqKwBAbiyBnU3bUh0ytbh6LCNWIbfe+4VGg+OstGeAjS5s1k7/h27GE gmC1qbx+aTHWPn/cqnyp0VI4j3Wmu5wECoT/P+gWauUSTqvyRALS4zWv7c1DVgnXPCNC 4zOQ== MIME-Version: 1.0 From: Vinay Kumar Date: Mon, 4 Nov 2019 16:39:58 +0530 Message-ID: Subject: Thread stack and heap caches - CVE-2019-1010024 To: libc-alpha@sourceware.org Cc: fweimer@redhat.com, carlos@redhat.com Content-Type: text/plain; charset="UTF-8" Hi, Regarding bug related to Thread stack and heap caches (CVE-2019-1010024). https://sourceware.org/bugzilla/show_bug.cgi?id=22852 >> One way to harden is to use a tunable for a thread stack cache, and set that to zero. Below change in glibc allocatestack.c file gives the expected output with test case. Verified on x86_64 target. ======================================================= --- a/nptl/allocatestack.c +++ b/nptl/allocatestack.c @@ -186,6 +186,7 @@ get_cached_stack (size_t *sizep, void **memp) struct pthread *curr; curr = list_entry (entry, struct pthread, list); + curr->stackblock_size = 0; if (FREE_P (curr) && curr->stackblock_size >= size) { if (curr->stackblock_size == size) ======================================================= Output with above patch in glibc trunk: strace -e mmap,munmap ./thread.out mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f387b0df000 mmap(NULL, 139704, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f387b0bc000 mmap(0x7f387b0c3000, 65536, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x7f387b0c3000 mmap(0x7f387b0d3000, 20480, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x7f387b0d3000 mmap(0x7f387b0d9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c000) = 0x7f387b0d9000 mmap(0x7f387b0db000, 12728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f387b0db000 mmap(NULL, 1774424, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f387af0a000 mmap(0x7f387af2f000, 1277952, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x25000) = 0x7f387af2f000 mmap(0x7f387b067000, 303104, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15d000) = 0x7f387b067000 mmap(0x7f387b0b2000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a7000) = 0x7f387b0b2000 mmap(0x7f387b0b8000, 13144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f387b0b8000 mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f387af07000 mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f387a706000 addr: 0x7f387af03ee0 value deadbeef malloced 0x7f3874000f70 mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3879f05000 addr: 0x7f387a702ee0 value 0 malloced 0x7f3874000f70 +++ exited with 0 +++ Re-sending due to bounce back of previous mail. Regards, Vinay